CVE-2026-77781
Received Received - Intake

Exception in Perl Tie::Hash::Regex for Invalid Regex Keys

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: CPANSec

Description
Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies. An application that looks up externally supplied strings in a tied hash will die on an invalid key.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-77781
EUVD
EUVD-2026-64205

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-248 An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Tie::Hash::Regex Perl module versions before 2.0.0. When malformed regular expressions are used as lookup keys in FETCH, EXISTS, or DELETE operations, the module throws an exception instead of handling them gracefully. This can cause applications to crash or behave unexpectedly when processing invalid regex patterns.

Detection Guidance

To detect this vulnerability, check the version of Tie::Hash::Regex installed on your system. Run: perl -MTie::Hash::Regex -e 'print $Tie::Hash::Regex::VERSION' If the output is less than 2.0.0, the system is vulnerable.

Impact Analysis

If your application uses Tie::Hash::Regex and processes user-supplied input as regex keys, this vulnerability could lead to denial-of-service conditions. The application may crash or terminate unexpectedly when encountering malformed regex patterns, disrupting normal operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it relates to Perl module exception handling rather than data protection or privacy controls.

Mitigation Strategies

Upgrade Tie::Hash::Regex to version 2.0.0 or later. Use: cpanm Tie::Hash::Regex@2.0.0 or update via your package manager. Ensure all Perl applications using this module are restarted after the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77781. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart