CVE catalog

CVE-2020-12723

perl: CVE-2020-12723

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Jun 1, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 5.97% · Oct 25, 2026

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	perl	sid	`5.42.3-1`	fixed
Debian	perl	forky	`5.42.3-1`	fixed
Debian	perl	trixie	`5.40.1-6+deb13u1`	fixed
Debian	perl	bookworm	`5.36.0-7+deb12u3`	fixed
Debian	perl	bookworm-security	`5.36.0-7+deb12u4`	fixed
Cpe	perl	Not reported	`5.30.3`	fixed
Cpe	oncommand_workflow_automation	Not reported	Not reported	unknown
Cpe	snap_creator_framework	Not reported	Not reported	unknown
Cpe	fedora	Not reported	Not reported	unknown
Cpe	leap	Not reported	Not reported	unknown
Cpe	communications_billing_and_revenue_management	Not reported	Not reported	unknown
Cpe	communications_diameter_signaling_router	Not reported	Not reported	unknown
Cpe	communications_eagle_application_processor	Not reported	Not reported	unknown
Cpe	communications_eagle_lnp_application_processor	Not reported	Not reported	unknown
Cpe	communications_lsms	Not reported	Not reported	unknown
Cpe	communications_offline_mediation_controller	Not reported	Not reported	unknown
Cpe	communications_performance_intelligence_center	Not reported	Not reported	unknown
Cpe	configuration_manager	Not reported	Not reported	unknown
Cpe	enterprise_manager_base_platform	Not reported	Not reported	unknown
Cpe	sd-wan_edge	Not reported	Not reported	unknown
Alpine	perl	3.10	`5.28.3-r0`	fixed
Alpine	perl	3.11	`5.30.3-r0`	fixed
Alpine	perl	3.12	`5.30.3-r0`	fixed
Alpine	perl	3.13	`5.30.3-r0`	fixed
Alpine	perl	3.14	`5.30.3-r0`	fixed
Alpine	perl	3.15	`5.30.3-r0`	fixed
Alpine	perl	3.16	`5.30.3-r0`	fixed
Alpine	perl	3.17	`5.30.3-r0`	fixed
Alpine	perl	3.18	`5.30.3-r0`	fixed
Alpine	perl	3.19	`5.30.3-r0`	fixed
Alpine	perl	3.20	`5.30.3-r0`	fixed
Alpine	perl	3.21	`5.30.3-r0`	fixed
Alpine	perl	3.22	`5.30.3-r0`	fixed
Alpine	perl	3.23	`5.30.3-r0`	fixed
Alpine	perl	3.24	`5.30.3-r0`	fixed
Alpine	perl	3.9	`5.26.3-r1`	fixed
Ubuntu	perl	pro	`5.14.2-21build1`	vulnerable
Ubuntu	perl	pro	`5.18.1-4`	vulnerable
Ubuntu	perl	pro	`5.18.1-4build1`	vulnerable
Ubuntu	perl	pro	`5.18.1-5`	vulnerable
Ubuntu	perl	pro	`5.18.2-2`	vulnerable
Ubuntu	perl	pro	`5.18.2-2ubuntu1`	vulnerable
Ubuntu	perl	pro	`5.18.2-2ubuntu1.1`	vulnerable
Ubuntu	perl	pro	`5.18.2-2ubuntu1.3`	vulnerable
Ubuntu	perl	pro	`5.18.2-2ubuntu1.4`	vulnerable
Ubuntu	perl	pro	`5.18.2-2ubuntu1.6`	vulnerable
Ubuntu	perl	pro	`5.18.2-2ubuntu1.7`	vulnerable
Ubuntu	perl	pro	`5.18.2-2ubuntu1.7+esm3`	fixed
Ubuntu	perl	16.04	`5.20.2-6`	vulnerable
Ubuntu	perl	16.04	`5.22.1-3`	vulnerable
Ubuntu	perl	16.04	`5.22.1-4`	vulnerable
Ubuntu	perl	16.04	`5.22.1-5`	vulnerable
Ubuntu	perl	16.04	`5.22.1-7`	vulnerable
Ubuntu	perl	16.04	`5.22.1-8`	vulnerable
Ubuntu	perl	16.04	`5.22.1-9`	vulnerable
Ubuntu	perl	16.04	`5.22.1-9ubuntu0.2`	vulnerable
Ubuntu	perl	16.04	`5.22.1-9ubuntu0.3`	vulnerable
Ubuntu	perl	16.04	`5.22.1-9ubuntu0.5`	vulnerable
Ubuntu	perl	16.04	`5.22.1-9ubuntu0.6`	vulnerable
Ubuntu	perl	16.04	`5.22.1-9ubuntu0.9`	fixed
Ubuntu	perl	18.04	`5.26.0-8ubuntu1`	vulnerable
Ubuntu	perl	18.04	`5.26.1-2ubuntu1`	vulnerable
Ubuntu	perl	18.04	`5.26.1-3`	vulnerable
Ubuntu	perl	18.04	`5.26.1-4`	vulnerable
Ubuntu	perl	18.04	`5.26.1-4build1`	vulnerable
Ubuntu	perl	18.04	`5.26.1-5`	vulnerable
Ubuntu	perl	18.04	`5.26.1-6`	vulnerable
Ubuntu	perl	18.04	`5.26.1-6ubuntu0.1`	vulnerable
Ubuntu	perl	18.04	`5.26.1-6ubuntu0.2`	vulnerable
Ubuntu	perl	18.04	`5.26.1-6ubuntu0.3`	vulnerable
Ubuntu	perl	18.04	`5.26.1-6ubuntu0.5`	fixed
Ubuntu	perl	20.04	`5.28.1-6build1`	vulnerable
Ubuntu	perl	20.04	`5.30.0-7`	vulnerable
Ubuntu	perl	20.04	`5.30.0-9`	vulnerable
Ubuntu	perl	20.04	`5.30.0-9build1`	vulnerable
Ubuntu	perl	20.04	`5.30.0-9ubuntu0.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	perl	source	sid	`5.30.3-1`	not yet assigned	Not reported	[962005]
Debian	perl	source	forky	`5.30.3-1`	not yet assigned	Not reported	[962005]
Debian	perl	source	trixie	`5.30.3-1`	not yet assigned	Not reported	[962005]
Debian	perl	source	bookworm	`5.30.3-1`	not yet assigned	Not reported	[962005]
Cpe	perl	cpe	Not reported	`5.30.3`	Not reported	NVD-CVE-2020-12723	Not reported
Alpine	perl	apk	3.10	`5.28.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.11	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.12	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.13	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.14	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.15	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.16	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.17	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.18	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.19	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.20	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.21	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.22	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.23	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.24	`5.30.3-r0`	Not reported	ALPINE-CVE-2020-12723	Not reported
Alpine	perl	apk	3.9	`5.26.3-r1`	Not reported	ALPINE-CVE-2020-12723	Not reported
Ubuntu	perl	deb	pro	`5.18.2-2ubuntu1.7+esm3`	Not reported	UBUNTU-CVE-2020-12723	Not reported
Ubuntu	perl	deb	16.04	`5.22.1-9ubuntu0.9`	Not reported	UBUNTU-CVE-2020-12723	Not reported
Ubuntu	perl	deb	18.04	`5.26.1-6ubuntu0.5`	Not reported	UBUNTU-CVE-2020-12723	Not reported
Ubuntu	perl	deb	20.04	`5.30.0-9ubuntu0.2`	Not reported	UBUNTU-CVE-2020-12723	Not reported

[Debian bug #962005]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libperl5.36]Unknown
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
[libperl-dev]Unknown
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
[perl]Unknown
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
[perl-base]Unknown
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
[perl-debug]Unknown
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
[perl-doc]Unknown
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u3 · all · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · all · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · all · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
[perl-modules-5.36]Unknown
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u3 · all · bookworm
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · all · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm
- 5.36.0-7+deb12u2 · all · bookworm-security
  Fixed · Fixed: 5.30.3-1
  dsa · perl · debian · bookworm

Observed: Oct 23, 2026, 5:47:28 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]