CVE-2026-57433 Details
Description
Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization.
A signed integer overflow vulnerability has been identified in the Perl Storable module, affecting versions prior to 3.41. The issue arises when deserializing a crafted SX_HOOK record. The function 'retrieve_hook_common' reads a signed 32-bit item count from the record and adds one before passing it to 'av_extend'. A count of I32_MAX causes the addition to wrap around to a negative value. This crafted blob, when processed by 'thaw' or 'retrieve', triggers the overflow, leading 'av_extend' to receive the negative count. This results in a panic, abruptly terminating the deserialization process.
Users can upgrade to Storable version 3.41 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch | CPANSec | Patch |
| http://www.openwall.com/lists/oss-security/2026/07/13/7 | CVE | Mailing ListPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| nwclark storable | < 3.41 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | Initial Analysis | [email protected] |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | CVE Modified | CVE |
| Jul 13, 2026 | New CVE Received | CPANSec |