The Tie::Hash::Regex Perl module versions prior to 2.0.0 have a vulnerability (CWE-248) where the FETCH, EXISTS, and DELETE methods throw exceptions on malformed regular expression keys. These methods attempt to compile the caller's key using a bare qr// operator without an eval guard, so if the key is not a valid regex pattern (e.g., contains an unmatched bracket), the operation dies. This can cause applications that look up externally supplied strings in such tied hashes to terminate unexpectedly due to uncaught exceptions.

Applications using Tie::Hash::Regex versions before 2.0.0 that perform lookups with externally supplied strings may crash or terminate unexpectedly when those strings are invalid regular expressions. This can lead to denial of service conditions in affected applications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using externally supplied strings as keys in Tie::Hash::Regex tied hashes or implement input validation to ensure keys are valid regular expressions before lookup.