{"id":"CVE-2020-10543","title":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.","summary":"Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cwe":["CWE-190","CWE-787"],"vendor":"perl","product":"perl","affected":["perl < 5.30.3","fedora = 31","leap = 15.1","communications_billing_and_revenue_management = 12.0.0.2.0","communications_billing_and_revenue_management = 12.0.0.3.0","communications_diameter_signaling_router >= 8.0.0, <= 8.5.0","communications_eagle_application_processor >= 16.1.0, <= 16.4.0","communications_eagle_lnp_application_processor = 10.1","communications_eagle_lnp_application_processor = 10.2","communications_eagle_lnp_application_processor = 46.7","communications_eagle_lnp_application_processor = 46.8","communications_eagle_lnp_application_processor = 46.9","communications_lsms >= 13.1, <= 13.4","communications_offline_mediation_controller = 12.0.0.3.0","communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1","communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1","communications_pricing_design_center = 12.0.0.3.0","configuration_manager = 12.1.2.0.8","enterprise_manager_base_platform = 13.4.0.0","sd-wan_edge = 8.2","sd-wan_edge = 9.0","sd-wan_edge = 9.1","tekelec_platform_distribution >= 7.4.0, <= 7.7.1"],"patched":["perl 5.30.3"],"published":"2020-06-05","updated":"2026-10-14","sourceUpdated":"2026-10-14T09:17:17.043","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-10543","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","label":"cve@mitre.org"},{"url":"https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202006-03","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20200611-0001/","label":"cve@mitre.org"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202006-03","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20200611-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.11334,"epssPercentile":0.95904,"ingestedAt":"2026-10-14T09:24:26.056Z","slug":"CVE-2020-10543","body":"## Overview\n\nPerl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.\n\n## Affected\n\n- `perl < 5.30.3`\n- `fedora = 31`\n- `leap = 15.1`\n- `communications_billing_and_revenue_management = 12.0.0.2.0`\n- `communications_billing_and_revenue_management = 12.0.0.3.0`\n- `communications_diameter_signaling_router >= 8.0.0, <= 8.5.0`\n- `communications_eagle_application_processor >= 16.1.0, <= 16.4.0`\n- `communications_eagle_lnp_application_processor = 10.1`\n- `communications_eagle_lnp_application_processor = 10.2`\n- `communications_eagle_lnp_application_processor = 46.7`\n- `communications_eagle_lnp_application_processor = 46.8`\n- `communications_eagle_lnp_application_processor = 46.9`\n- `communications_lsms >= 13.1, <= 13.4`\n- `communications_offline_mediation_controller = 12.0.0.3.0`\n- `communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1`\n- `communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1`\n- `communications_pricing_design_center = 12.0.0.3.0`\n- `configuration_manager = 12.1.2.0.8`\n- `enterprise_manager_base_platform = 13.4.0.0`\n- `sd-wan_edge = 8.2`\n- `sd-wan_edge = 9.0`\n- `sd-wan_edge = 9.1`\n- `tekelec_platform_distribution >= 7.4.0, <= 7.7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `perl 5.30.3`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":45.1,"likelihood":2.3,"exploitation":0,"ransomware":0},"changes":[]}