CVE-2026-77781: CWE-248 Uncaught Exception
Description
Tie::Hash::Regex versions before 2.0.0 for Perl contain a vulnerability where malformed regular expression keys cause the FETCH, EXISTS, and DELETE methods to throw uncaught exceptions. This occurs because these methods compile the caller's key as a regex without proper error handling, causing the application to die if the key is invalid. This can lead to denial of service if externally supplied strings are used as lookup keys.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In Tie::Hash::Regex versions prior to 2.0.0, the FETCH, EXISTS, and DELETE methods attempt to compile lookup keys as regular expressions without an eval guard. When a key is not a valid regex pattern (e.g., contains unmatched brackets), the compilation throws an uncaught exception, causing the application to terminate unexpectedly. This vulnerability arises from the lack of exception handling around regex compilation in these methods, affecting applications that use externally supplied strings as keys in tied hashes.
Potential Impact
The vulnerability can cause denial of service by crashing applications that perform lookups with malformed regular expression keys. There is no direct impact on confidentiality or integrity, but availability is affected due to application termination.
Mitigation Recommendations
A fix is available in Tie::Hash::Regex version 2.0.0 and later. Users should upgrade to version 2.0.0 or newer to prevent uncaught exceptions from malformed regex keys. Until upgraded, applications should validate or sanitize externally supplied keys before using them in tied hashes to avoid triggering the exception.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-08-21T11:41:39.920Z
- State
- PUBLISHED
Threat ID: 6a88e84dacd9273b49ea557b
Added to database: 08/22/2026, 00:07:41 UTC
Last enriched: 09/10/2026, 15:19:04 UTC
Last updated: 10/05/2026, 18:48:22 UTC
Views: 78
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.