--- id: CVE-2020-10878 title: >- Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation summary: >- Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. severity: high cvss: 8.6 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H' cwe: - CWE-190 vendor: perl product: perl affected: - perl < 5.30.3 - fedora = 31 - leap = 15.1 - oncommand_workflow_automation - snap_creator_framework - communications_billing_and_revenue_management = 12.0.0.2.0 - communications_billing_and_revenue_management = 12.0.0.3.0 - 'communications_diameter_signaling_router >= 8.0.0, <= 8.5.0' - 'communications_eagle_application_processor >= 16.1.0, <= 16.4.0' - communications_eagle_lnp_application_processor = 10.1 - communications_eagle_lnp_application_processor = 10.2 - communications_eagle_lnp_application_processor = 46.7 - communications_eagle_lnp_application_processor = 46.8 - communications_eagle_lnp_application_processor = 46.9 - 'communications_lsms >= 13.1, <= 13.4' - communications_offline_mediation_controller = 12.0.0.3.0 - 'communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1' - 'communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1' - communications_pricing_design_center = 12.0.0.3.0 - configuration_manager = 12.1.2.0.8 - enterprise_manager_base_platform = 13.4.0.0 - sd-wan_aware = 8.2 - sd-wan_aware = 9.0 - sd-wan_aware = 9.1 - 'tekelec_platform_distribution >= 7.4.0, <= 7.7.1' patched: - perl 5.30.3 published: '2020-06-05' updated: '2026-10-14' sourceUpdated: '2026-10-14T09:17:17.657' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-10878' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3' label: cve@mitre.org - url: >- https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8 label: cve@mitre.org - url: >- https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202006-03' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200611-0001/' label: cve@mitre.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/perl/perl5/commit/0a320d753fe7fca03df259a4dfd8e641e51edaa8 label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/perl/perl5/commit/3295b48defa0f8570114877b063fe546dd348b3c label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202006-03' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200611-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.04879 epssPercentile: 0.91878 ingestedAt: '2026-10-14T09:24:26.056Z' --- ## Overview Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. ## Affected - `perl < 5.30.3` - `fedora = 31` - `leap = 15.1` - `oncommand_workflow_automation` - `snap_creator_framework` - `communications_billing_and_revenue_management = 12.0.0.2.0` - `communications_billing_and_revenue_management = 12.0.0.3.0` - `communications_diameter_signaling_router >= 8.0.0, <= 8.5.0` - `communications_eagle_application_processor >= 16.1.0, <= 16.4.0` - `communications_eagle_lnp_application_processor = 10.1` - `communications_eagle_lnp_application_processor = 10.2` - `communications_eagle_lnp_application_processor = 46.7` - `communications_eagle_lnp_application_processor = 46.8` - `communications_eagle_lnp_application_processor = 46.9` - `communications_lsms >= 13.1, <= 13.4` - `communications_offline_mediation_controller = 12.0.0.3.0` - `communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1` - `communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1` - `communications_pricing_design_center = 12.0.0.3.0` - `configuration_manager = 12.1.2.0.8` - `enterprise_manager_base_platform = 13.4.0.0` - `sd-wan_aware = 8.2` - `sd-wan_aware = 9.0` - `sd-wan_aware = 9.1` - `tekelec_platform_distribution >= 7.4.0, <= 7.7.1` ## Remediation Upgrade past the affected range: - `perl 5.30.3`