CVE-2026-13221 describes an integer overflow (CWE-190) in Perl's regular expression engine (Perl_study_chunk) affecting versions through 5.43.9. When an alternation pattern contains more than 65535 fixed string branches compiled into a trie, a 16-bit field storing the delta overflows, truncating the trie's match decision table without warning. This leads to silently incorrect matching behavior, producing both false positives and false negatives. The vulnerability impacts the correctness of regex-based filtering or access control decisions that rely on these patterns.

The vulnerability causes Perl to produce incorrect regular expression matches silently, which can lead to security controls based on these regex patterns making incorrect decisions. This may result in unauthorized access being granted or legitimate access being denied, depending on the use case. There is no indication of remote code execution or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should avoid using regex patterns with more than 65535 fixed string branches in alternations until a fix is available.