Critical Security Update for Perl Package: Important Vulnerabilities Addressed
Summary
ALSA-2026:30851: Important: perl:5.32 security update. Affects perl versions < 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c. Fixed in 4:5.32.1-474.module_el8.10.0+4162+0aac7c4c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Perl is a high-level programming language widely utilized for system administration utilities, web programming, and network programming. It is known for its flexibility and power, making it a popular choice among developers. However, recent vulnerabilities have been identified in various Perl packages, necessitating immediate attention to ensure the security of applications relying on these packages.
Vulnerability Detail
The vulnerabilities stem from two critical issues: a path traversal vulnerability in the perl-archive-tar package, which allows attackers to access arbitrary files via crafted symlinks (CVE-2026-42496), and an arbitrary code execution vulnerability in the perl-IO-Compress package, which can be exploited through attacker-controlled output glob (CVE-2026-48962). These vulnerabilities can lead to severe security breaches, including unauthorized access to sensitive data and execution of malicious code.
How To Fix
Minimum fixed version
4:5.32.1-474.module_el8.10.0+4162+0aac7c4c
This is the first release that contains the fix.
sudo dnf update perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider restricting access to the affected packages or implementing additional security measures such as file system permissions to mitigate the risk of exploitation until the updates can be applied.
Conclusion
The identified vulnerabilities in Perl packages pose serious security risks that require immediate attention. Updating the affected packages to their patched versions is crucial to maintaining the integrity and security of applications. Regular monitoring and prompt updates are essential practices for safeguarding against such vulnerabilities.
See every vulnerability recorded for perl →
FAQ
The vulnerabilities include a path traversal issue in perl-archive-tar and an arbitrary code execution vulnerability in perl-IO-Compress.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application without signup at the Vulert playground.
Exploitation of these vulnerabilities can lead to unauthorized access to sensitive files and execution of arbitrary code, posing significant security risks.
It is recommended to regularly check for updates and apply them promptly to mitigate security risks associated with vulnerabilities.
Implement temporary workarounds such as restricting access to the affected packages and enhancing security measures until updates can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for perl.
