CVE-2026-14895: CWE-1333 Inefficient Regular Expression Complexity in BAKERSCOT String::Util
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s*$ with \s+$. Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.
AI Analysis
Technical Summary
The vulnerability in BAKERSCOT String::Util (CVE-2026-14895) affects versions prior to 1.36. The trim and rtrim functions use a regular expression s/\s*$//u to remove trailing whitespace. Because \s* matches greedily and the end-of-string anchor ($) fails when non-whitespace characters follow, the regex engine performs excessive backtracking on long whitespace sequences, causing a denial of service via CPU exhaustion. The fix replaces \s*$ with \s+$ to prevent this inefficiency. Untrusted input passed to these functions can trigger the vulnerability.
Potential Impact
An attacker can cause a denial of service by supplying input with a long sequence of whitespace to the trim or rtrim functions, leading to high CPU usage and potential service disruption. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The known fix involves updating to String::Util version 1.36 or later where the regex pattern has been corrected. Until a patch is applied, avoid passing untrusted input containing long whitespace runs to the trim or rtrim functions.
CVE-2026-14895: CWE-1333 Inefficient Regular Expression Complexity in BAKERSCOT String::Util
Description
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s*$ with \s+$. Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in BAKERSCOT String::Util (CVE-2026-14895) affects versions prior to 1.36. The trim and rtrim functions use a regular expression s/\s*$//u to remove trailing whitespace. Because \s* matches greedily and the end-of-string anchor ($) fails when non-whitespace characters follow, the regex engine performs excessive backtracking on long whitespace sequences, causing a denial of service via CPU exhaustion. The fix replaces \s*$ with \s+$ to prevent this inefficiency. Untrusted input passed to these functions can trigger the vulnerability.
Potential Impact
An attacker can cause a denial of service by supplying input with a long sequence of whitespace to the trim or rtrim functions, leading to high CPU usage and potential service disruption. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The known fix involves updating to String::Util version 1.36 or later where the regex pattern has been corrected. Until a patch is applied, avoid passing untrusted input containing long whitespace runs to the trim or rtrim functions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-07-06T18:31:10.251Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4d8138c9d9e3dbe3f681c0
Added to database: 07/07/2026, 22:44:08 UTC
Last enriched: 07/15/2026, 12:11:32 UTC
Last updated: 08/19/2026, 22:52:10 UTC
Views: 123
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.