← All notices | Source (USN-8675-1) | Text version

QSN-8675-1: Perl vulnerabilities

August 25, 2026

Summary

Several security issues were fixed in Perl.

Details

It was discovered that Perl incorrectly handled short source addresses in the Socket module. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-12087)

It was discovered that Perl incorrectly handled regular expressions containing a large number of fixed string alternatives. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-13221)

It was discovered that Perl incorrectly handled certain large repeat counts when processing pack and unpack templates. An attacker could possibly use this issue to trigger an out-of-bounds heap read, resulting in information disclosure. (CVE-2026-57432)

It was discovered that Perl incorrectly handled certain crafted data when deserializing with the Storable module. An attacker could possibly use this issue to trigger an integer overflow and application termination, resulting in a denial of service. (CVE-2026-57433)

Affected QuantaStor releases

ReleasePlatformPackageExposureShipped versionFixed versionStatus
6.9.1.001Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.9.1.001Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.9.1.001Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.9.1.001Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.9.0.464Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.9.0.464Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.9.0.464Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.9.0.464Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.8.6.015Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.8.6.015Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.8.6.015Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.8.6.015Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.95.34.0-3ubuntu1.8Fixed in this release
6.8.5.018Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.5.018Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.4.038Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.3.018Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.2.002Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.1.007Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSlibperl5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSperlInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSperl-baseInternally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update
6.8.0.205Ubuntu 22.04 LTSperl-modules-5.34Internally-facing5.34.0-3ubuntu1.75.34.0-3ubuntu1.8Fixed by QuantaStor security update

Internally-facing: only accessible when logged into the QuantaStor console/ssh as the qadmin administrative sudo user; generally lower priority. Externally-facing: part of a service the storage platform presents on the network (or the kernel), so potentially reachable over the network.

CVEs

CVE-2026-13221, CVE-2026-12087, CVE-2026-57433, CVE-2026-57432

References

https://ubuntu.com/security/notices/USN-8675-1

https://nvd.nist.gov/vuln/detail/CVE-2026-13221

https://nvd.nist.gov/vuln/detail/CVE-2026-12087

https://nvd.nist.gov/vuln/detail/CVE-2026-57433

https://nvd.nist.gov/vuln/detail/CVE-2026-57432

Update

Fixes marked Fixed by QuantaStor security update are applied by upgrading QuantaStor with security patches included (Upgrade Manager). Fixed package versions:

PlatformPackageVersion
bionicperl5.26.1-6ubuntu0.7+esm3
Ubuntu 20.04 LTSperl5.30.0-9ubuntu0.5+esm3
Ubuntu 22.04 LTSperl5.34.0-3ubuntu1.8
trustyperl5.18.2-2ubuntu1.7+esm8
xenialperl5.22.1-9ubuntu0.9+esm3