CVE-2026-13221: CWE-190 Integer Overflow or Wraparound

CVE-2026-13221 is an integer overflow vulnerability (CWE-190) in Perl's regular expression engine affecting versions up to 5.43.9. When a regex pattern includes an alternation with more than 65535 fixed string branches compiled into a trie, a 16-bit field storing the delta between the first branch and the shared tail overflows. This truncates the trie's match decision table without warning or error, causing the regex engine to produce silently incorrect matches. The vulnerability impacts the integrity of regex matching, potentially leading to false positive and false negative matches, which can affect access control or filtering mechanisms relying on these patterns.

The vulnerability causes the Perl regex engine to produce incorrect matching results, including false positives and false negatives, without any warning. This can lead to security controls based on regex patterns making incorrect decisions, potentially allowing unauthorized access or blocking legitimate requests. The CVSS score of 9.1 indicates a critical severity with high impact on integrity and availability, exploitable remotely without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using regex patterns with more than 65535 fixed string branches in alternations. Review and test regex patterns that gate access or filtering decisions to ensure correctness. Monitor vendor communications for official patches or updates.