--- id: CVE-2020-12723 title: >- regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. summary: >- regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-120 vendor: perl product: perl affected: - perl < 5.30.3 - oncommand_workflow_automation - snap_creator_framework - fedora = 31 - leap = 15.1 - communications_billing_and_revenue_management = 12.0.0.2.0 - communications_billing_and_revenue_management = 12.0.0.3.0 - 'communications_diameter_signaling_router >= 8.0.0, <= 8.5.0' - 'communications_eagle_application_processor >= 16.1.0, <= 16.4.0' - communications_eagle_lnp_application_processor = 10.1 - communications_eagle_lnp_application_processor = 10.2 - 'communications_lsms >= 13.1, <= 13.4' - communications_offline_mediation_controller = 12.0.0.3.0 - 'communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1' - 'communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1' - configuration_manager = 12.1.2.0.8 - enterprise_manager_base_platform = 13.4.0.0 - sd-wan_edge = 8.2 - sd-wan_edge = 9.0 - sd-wan_edge = 9.1 - 'tekelec_platform_distribution >= 7.4.0, <= 7.7.1' patched: - perl 5.30.3 published: '2020-06-05' updated: '2026-10-14' sourceUpdated: '2026-10-14T10:17:26.177' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-12723' references: - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/issues/16947' label: cve@mitre.org - url: 'https://github.com/Perl/perl5/issues/17743' label: cve@mitre.org - url: >- https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a label: cve@mitre.org - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ label: cve@mitre.org - url: 'https://security.gentoo.org/glsa/202006-03' label: cve@mitre.org - url: 'https://security.netapp.com/advisory/ntap-20200611-0001/' label: cve@mitre.org - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: cve@mitre.org - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: cve@mitre.org - url: 'http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/issues/16947' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://github.com/Perl/perl5/issues/17743' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202006-03' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20200611-0001/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2020.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.05971 epssPercentile: 0.93145 ingestedAt: '2026-10-14T10:25:41.176Z' --- ## Overview regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. ## Affected - `perl < 5.30.3` - `oncommand_workflow_automation` - `snap_creator_framework` - `fedora = 31` - `leap = 15.1` - `communications_billing_and_revenue_management = 12.0.0.2.0` - `communications_billing_and_revenue_management = 12.0.0.3.0` - `communications_diameter_signaling_router >= 8.0.0, <= 8.5.0` - `communications_eagle_application_processor >= 16.1.0, <= 16.4.0` - `communications_eagle_lnp_application_processor = 10.1` - `communications_eagle_lnp_application_processor = 10.2` - `communications_lsms >= 13.1, <= 13.4` - `communications_offline_mediation_controller = 12.0.0.3.0` - `communications_performance_intelligence_center >= 10.3.0.0.0, <= 10.3.0.2.1` - `communications_performance_intelligence_center >= 10.4.0.1.0, <= 10.4.0.3.1` - `configuration_manager = 12.1.2.0.8` - `enterprise_manager_base_platform = 13.4.0.0` - `sd-wan_edge = 8.2` - `sd-wan_edge = 9.0` - `sd-wan_edge = 9.1` - `tekelec_platform_distribution >= 7.4.0, <= 7.7.1` ## Remediation Upgrade past the affected range: - `perl 5.30.3`