{"id":"CVE-2020-12723","title":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.","summary":"regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-120"],"vendor":"perl","product":"perl","affected":["perl < 5.30.3","oncommand_workflow_automation","snap_creator_framework","fedora = 31","leap = 15.1","communications_billing_and_revenue_management = 12.0.0.2.0","communications_billing_and_revenue_management = 12.0.0.3.0","communications_diameter_signaling_router >= 8.0.0, <= 8.5.0","communications_eagle_application_processor >= 16.1.0, <= 16.4.0","communications_eagle_lnp_application_processor = 10.1","communications_eagle_lnp_application_processor = 10.2","communications_lsms >= 13.1, <= 13.4","communications_offline_mediation_controller = 12.0.0.3.0","communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1","communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1","configuration_manager = 12.1.2.0.8","enterprise_manager_base_platform = 13.4.0.0","sd-wan_edge = 8.2","sd-wan_edge = 9.0","sd-wan_edge = 9.1","tekelec_platform_distribution >= 7.4.0, <= 7.7.1"],"patched":["perl 5.30.3"],"published":"2020-06-05","updated":"2026-10-14","sourceUpdated":"2026-10-14T10:17:26.177","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2020-12723","references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/issues/16947","label":"cve@mitre.org"},{"url":"https://github.com/Perl/perl5/issues/17743","label":"cve@mitre.org"},{"url":"https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","label":"cve@mitre.org"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","label":"cve@mitre.org"},{"url":"https://security.gentoo.org/glsa/202006-03","label":"cve@mitre.org"},{"url":"https://security.netapp.com/advisory/ntap-20200611-0001/","label":"cve@mitre.org"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"cve@mitre.org"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"cve@mitre.org"},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/issues/16947","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/Perl/perl5/issues/17743","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.gentoo.org/glsa/202006-03","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20200611-0001/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd"],"epss":0.05971,"epssPercentile":0.93145,"ingestedAt":"2026-10-14T10:25:41.176Z","slug":"CVE-2020-12723","body":"## Overview\n\nregcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.\n\n## Affected\n\n- `perl < 5.30.3`\n- `oncommand_workflow_automation`\n- `snap_creator_framework`\n- `fedora = 31`\n- `leap = 15.1`\n- `communications_billing_and_revenue_management = 12.0.0.2.0`\n- `communications_billing_and_revenue_management = 12.0.0.3.0`\n- `communications_diameter_signaling_router >= 8.0.0, <= 8.5.0`\n- `communications_eagle_application_processor >= 16.1.0, <= 16.4.0`\n- `communications_eagle_lnp_application_processor = 10.1`\n- `communications_eagle_lnp_application_processor = 10.2`\n- `communications_lsms >= 13.1, <= 13.4`\n- `communications_offline_mediation_controller = 12.0.0.3.0`\n- `communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1`\n- `communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1`\n- `configuration_manager = 12.1.2.0.8`\n- `enterprise_manager_base_platform = 13.4.0.0`\n- `sd-wan_edge = 8.2`\n- `sd-wan_edge = 9.0`\n- `sd-wan_edge = 9.1`\n- `tekelec_platform_distribution >= 7.4.0, <= 7.7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `perl 5.30.3`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":1.2,"exploitation":0,"ransomware":0},"changes":[]}