CVE catalog

CVE-2018-18311

perl: CVE-2018-18311

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
11.68% · Oct 25, 2026

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianperlsid5.42.3-1fixed
Debianperlforky5.42.3-1fixed
Debianperltrixie5.40.1-6+deb13u1fixed
Debianperlbookworm5.36.0-7+deb12u3fixed
Debianperlbookworm-security5.36.0-7+deb12u4fixed
Alpineperl3.105.26.3-r0fixed
Alpineperl3.115.26.3-r0fixed
Alpineperl3.125.26.3-r0fixed
Alpineperl3.135.26.3-r0fixed
Alpineperl3.145.26.3-r0fixed
Alpineperl3.155.26.3-r0fixed
Alpineperl3.165.26.3-r0fixed
Alpineperl3.175.26.3-r0fixed
Alpineperl3.185.26.3-r0fixed
Alpineperl3.195.26.3-r0fixed
Alpineperl3.205.26.3-r0fixed
Alpineperl3.215.26.3-r0fixed
Alpineperl3.225.26.3-r0fixed
Alpineperl3.235.26.3-r0fixed
Alpineperl3.245.26.3-r0fixed
Alpineperl3.65.24.4-r2fixed
Alpineperl3.75.26.3-r0fixed
Alpineperl3.85.26.3-r0fixed
Alpineperl3.95.26.3-r0fixed
Ubuntuperl14.045.14.2-21build1vulnerable
Ubuntuperl14.045.18.1-4vulnerable
Ubuntuperl14.045.18.1-4build1vulnerable
Ubuntuperl14.045.18.1-5vulnerable
Ubuntuperl14.045.18.2-2vulnerable
Ubuntuperl14.045.18.2-2ubuntu1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.3vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.4vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.6vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.7fixed
Ubuntuperl16.045.20.2-6vulnerable
Ubuntuperl16.045.22.1-3vulnerable
Ubuntuperl16.045.22.1-4vulnerable
Ubuntuperl16.045.22.1-5vulnerable
Ubuntuperl16.045.22.1-7vulnerable
Ubuntuperl16.045.22.1-8vulnerable
Ubuntuperl16.045.22.1-9vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.2vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.3vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.5vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.6fixed
Ubuntuperl18.045.26.0-8ubuntu1vulnerable
Ubuntuperl18.045.26.1-2ubuntu1vulnerable
Ubuntuperl18.045.26.1-3vulnerable
Ubuntuperl18.045.26.1-4vulnerable
Ubuntuperl18.045.26.1-4build1vulnerable
Ubuntuperl18.045.26.1-5vulnerable
Ubuntuperl18.045.26.1-6vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.1vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.2vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.3fixed
Ubuntuperl14.045.14.2-21build1vulnerable
Ubuntuperl14.045.18.1-4vulnerable
Ubuntuperl14.045.18.1-4build1vulnerable
Ubuntuperl14.045.18.1-5vulnerable
Ubuntuperl14.045.18.2-2vulnerable
Ubuntuperl14.045.18.2-2ubuntu1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.1vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.3vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.4vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.6vulnerable
Ubuntuperl14.045.18.2-2ubuntu1.7fixed
Ubuntuperl16.045.20.2-6vulnerable
Ubuntuperl16.045.22.1-3vulnerable
Ubuntuperl16.045.22.1-4vulnerable
Ubuntuperl16.045.22.1-5vulnerable
Ubuntuperl16.045.22.1-7vulnerable
Ubuntuperl16.045.22.1-8vulnerable
Ubuntuperl16.045.22.1-9vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.2vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.3vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.5vulnerable
Ubuntuperl16.045.22.1-9ubuntu0.6fixed
Ubuntuperl18.045.26.0-8ubuntu1vulnerable
Ubuntuperl18.045.26.1-2ubuntu1vulnerable
Ubuntuperl18.045.26.1-3vulnerable
Ubuntuperl18.045.26.1-4vulnerable
Ubuntuperl18.045.26.1-4build1vulnerable
Ubuntuperl18.045.26.1-5vulnerable
Ubuntuperl18.045.26.1-6vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.1vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.2vulnerable
Ubuntuperl18.045.26.1-6ubuntu0.3fixed
Suseperllinux enterprise module for basesystem 155.26.1-7.6.1fixed
Suseperllinux enterprise module for development tools 155.26.1-7.6.1fixed
Suseperlhpe helion openstack 85.18.2-12.20.1fixed
Suseperlopenstack cloud 75.18.2-12.20.1fixed
Suseperlopenstack cloud 85.18.2-12.20.1fixed
Suseperlopenstack cloud crowbar 85.18.2-12.20.1fixed
Suseperllinux enterprise desktop 12 sp45.18.2-12.20.1fixed
Suseperllinux enterprise server for sap applications 12 sp15.18.2-12.20.1fixed
Suseperllinux enterprise server for sap applications 12 sp25.18.2-12.20.1fixed
Suseperllinux enterprise server for sap applications 12 sp35.18.2-12.20.1fixed
Suseperllinux enterprise server 12 sp1-ltss5.18.2-12.20.1fixed
Suseperllinux enterprise server 12 sp2-ltss5.18.2-12.20.1fixed
Suseperllinux enterprise server 12 sp2-bcl5.18.2-12.20.1fixed
Suseperllinux enterprise server 12 sp3-ltss5.18.2-12.20.1fixed
Suseperllinux enterprise server 12 sp3-bcl5.18.2-12.20.1fixed
Suseperllinux enterprise server 12 sp45.18.2-12.20.1fixed
Suseperllinux enterprise server for sap applications 12 sp45.18.2-12.20.1fixed
Suseperlenterprise storage 45.18.2-12.20.1fixed
Suseperlenterprise storage 55.18.2-12.20.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianperlsourcesid5.28.1-1not yet assignedNot reportedNot reported
Debianperlsourceforky5.28.1-1not yet assignedNot reportedNot reported
Debianperlsourcetrixie5.28.1-1not yet assignedNot reportedNot reported
Debianperlsourcebookworm5.28.1-1not yet assignedNot reportedNot reported
Alpineperlapk3.105.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.115.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.125.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.135.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.145.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.155.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.165.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.175.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.185.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.195.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.205.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.215.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.225.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.235.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.245.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.65.24.4-r2Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.75.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.85.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Alpineperlapk3.95.26.3-r0Not reportedALPINE-CVE-2018-18311Not reported
Ubuntuperldeb14.045.18.2-2ubuntu1.7Not reportedUBUNTU-CVE-2018-18311Not reported
Ubuntuperldeb16.045.22.1-9ubuntu0.6Not reportedUBUNTU-CVE-2018-18311Not reported
Ubuntuperldeb18.045.26.1-6ubuntu0.3Not reportedUBUNTU-CVE-2018-18311Not reported
Ubuntuperldeb14.045.18.2-2ubuntu1.7Not reportedUSN-3834-1Not reported
Ubuntuperldeb16.045.22.1-9ubuntu0.6Not reportedUSN-3834-1Not reported
Ubuntuperldeb18.045.26.1-6ubuntu0.3Not reportedUSN-3834-1Not reported
Suseperlrpmlinux enterprise module for basesystem 155.26.1-7.6.1Not reportedSUSE-SU-2018:4187-1Not reported
Suseperlrpmlinux enterprise module for development tools 155.26.1-7.6.1Not reportedSUSE-SU-2018:4187-1Not reported
Suseperlrpmhpe helion openstack 85.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmopenstack cloud 75.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmopenstack cloud 85.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmopenstack cloud crowbar 85.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise desktop 12 sp45.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server for sap applications 12 sp15.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server for sap applications 12 sp25.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server for sap applications 12 sp35.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server 12 sp1-ltss5.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server 12 sp2-ltss5.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server 12 sp2-bcl5.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server 12 sp3-ltss5.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server 12 sp3-bcl5.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server 12 sp45.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmlinux enterprise server for sap applications 12 sp45.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmenterprise storage 45.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported
Suseperlrpmenterprise storage 55.18.2-12.20.1Not reportedSUSE-SU-2019:2264-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl]Fixed
    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl-base]Fixed

    Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl-debug]Fixed

    Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · amd64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · arm64 · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · amd64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · arm64 · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • [perl-doc]Fixed

    Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

  • Source package: [perl]

    Details (4)
    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u3 · all · bookworm

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

    • 5.36.0-7+deb12u2 · all · bookworm-security

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · bookworm; dsa · perl · debian · 12

[Debian 13 (Trixie)]

  • Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

  • Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

  • [perl]Fixed
    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

  • [perl-base]Fixed

    Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

  • [perl-debug]Fixed

    Source package: [perl]

    Details (2)
    • 5.40.1-6 · amd64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

    • 5.40.1-6 · arm64 · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

  • [perl-doc]Fixed

    Source package: [perl]

    Details (2)
    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

  • Source package: [perl]

    Details (2)
    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

    • 5.40.1-6 · all · trixie

      Fixed · Fixed: 5.28.1-1

      dsa · perl · debian · 13

Observed:

References