Sereal::Decoder versions prior to 5.005 for Perl contain a heap out-of-bounds read vulnerability (CWE-125) in the srl_read_object() and srl_read_hash() functions. When processing a COPY tag, which is a back-reference, the decoder re-decodes the target byte as a fresh tag. If this target byte matches the SHORT_BINARY pattern, the decoder reads beyond the input buffer boundary because the read is not properly bounded relative to the COPY tag's offset. An attacker can craft a COPY offset that points inside a previously decoded value, causing the decoder to interpret arbitrary heap bytes as a SHORT_BINARY tag and consume up to 31 bytes from the heap as class names or hash keys. This can lead to information disclosure and potentially denial of service.

The vulnerability allows an attacker to cause the decoder to read beyond the intended input buffer, potentially leaking sensitive heap memory contents. The CVSS score of 8.1 indicates high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts confidentiality and availability. There is no indication of integrity impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, avoid processing untrusted or malformed Sereal-encoded data to reduce risk.