{"id":"CVE-2023-47038","details":"A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.","modified":"2026-04-16T04:32:22.776895828Z","published":"2023-12-18T14:15:08.933Z","related":["ALSA-2024:2228","ALSA-2024:3128","openSUSE-SU-2024:13479-1"],"references":[{"type":"WEB","url":"https://github.com/aquasecurity/trivy/discussions/8400"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMDZZ4SCEW6FRWZDMXGAKZ35THTAWFG6/"},{"type":"WEB","url":"https://ubuntu.com/security/CVE-2023-47100"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2023-47100.html"},{"type":"ADVISORY","url":"https://perldoc.perl.org/perl5382delta#CVE-2023-47038-Write-past-buffer-end-via-illegal-user-defined-Unicode-property"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-47038"},{"type":"ADVISORY","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNEEWAACXQCEEAKSG7XX2D5YDRWLCIZJ/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:2228"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:3128"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249523"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6"},{"type":"FIX","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3"},{"type":"FIX","url":"https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/perl/perl5","events":[{"introduced":"44523d1ffde5f23de2e13216cdbac46357631904"},{"last_affected":"76298ae68aa7796f0ffc05095b127d23f4b2de8f"},{"fixed":"12c313ce49b36160a7ca2e9b07ad5bd92ee4a010"},{"fixed":"7047915eef37fccd93e7cd985c29fe6be54650b6"},{"fixed":"ff1f9f59360afeebd6f75ca1502f5c3ebf077da3"}],"database_specific":{"versions":[{"introduced":"5.30.0"},{"last_affected":"5.38.0"}]}}],"versions":["v5.30.0","v5.31.0","v5.31.1","v5.31.11","v5.31.2","v5.31.3","v5.31.4","v5.31.5","v5.31.7","v5.32.0","v5.32.0-RC1","v5.33.0","v5.33.1","v5.33.2","v5.33.3","v5.33.4","v5.33.7","v5.33.8","v5.33.9","v5.34.0","v5.34.0-RC1","v5.34.0-RC2","v5.34.1","v5.34.1-RC1","v5.34.1-RC2","v5.35.0","v5.35.10","v5.35.11","v5.35.3","v5.35.5","v5.35.6","v5.35.8","v5.35.9","v5.36.0","v5.36.0-RC3","v5.36.1","v5.36.1-RC1","v5.36.1-RC2","v5.36.1-RC3","v5.37.0","v5.37.1","v5.37.10","v5.37.11","v5.37.2","v5.37.3","v5.37.4","v5.37.5","v5.37.6","v5.37.7","v5.37.9","v5.38.0","v5.38.0-RC1","v5.38.0-RC2","v5.39.0","v5.39.1","v5.39.3","v5.39.4","v5.39.5"],"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"39"}]},{"events":[{"introduced":"0"},{"last_affected":"8.0"}]},{"events":[{"introduced":"0"},{"last_affected":"9.0"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4"}]},{"events":[{"introduced":"0"},{"last_affected":"9.4"}]}],"vanir_signatures":[{"target":{"file":"regcomp.c"},"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"CVE-2023-47038-25a411b3","digest":{"line_hashes":["293151830564086057975937478145914932521","143453480806131793255850162682972791677","49908078177243315762977250841678391040","42104507940110116460481038906207795532","292801548212068716341663467870433321819","212097729157823892197038680263482191794","144636467486871689450262130624485683886","335528991668785098518339371645954218045","299294200457540300074871374773975371398","167558216281262761149252772934203375680","228324759900382015466878919495742988297","74020277280142741159892597680004234788","113932126825401564749306971437333044127","247111147840606110998218129682026188629","138101284308869327359391341269680722528","8701125679094550235987128839545290268","115265112681309483517465494462799681859","84378174528897378644201700403584698336"],"threshold":0.9},"source":"https://github.com/perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3"},{"signature_version":"v1","deprecated":false,"signature_type":"Line","target":{"file":"regcomp.c"},"id":"CVE-2023-47038-693fbd38","digest":{"line_hashes":["293151830564086057975937478145914932521","143453480806131793255850162682972791677","49908078177243315762977250841678391040","42104507940110116460481038906207795532","335342254380232159137657033313261520238","142206445844056675113002677752098323015","144636467486871689450262130624485683886","335528991668785098518339371645954218045","299294200457540300074871374773975371398","167558216281262761149252772934203375680","228324759900382015466878919495742988297","74020277280142741159892597680004234788","113932126825401564749306971437333044127","247111147840606110998218129682026188629","138101284308869327359391341269680722528","8701125679094550235987128839545290268","115265112681309483517465494462799681859","84378174528897378644201700403584698336"],"threshold":0.9},"source":"https://github.com/perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010"},{"target":{"file":"regcomp.c"},"deprecated":false,"signature_type":"Line","signature_version":"v1","id":"CVE-2023-47038-e5f4bbb5","digest":{"line_hashes":["293151830564086057975937478145914932521","143453480806131793255850162682972791677","49908078177243315762977250841678391040","42104507940110116460481038906207795532","335342254380232159137657033313261520238","142206445844056675113002677752098323015","144636467486871689450262130624485683886","335528991668785098518339371645954218045","299294200457540300074871374773975371398","167558216281262761149252772934203375680","228324759900382015466878919495742988297","74020277280142741159892597680004234788","113932126825401564749306971437333044127","247111147840606110998218129682026188629","138101284308869327359391341269680722528","8701125679094550235987128839545290268","115265112681309483517465494462799681859","84378174528897378644201700403584698336"],"threshold":0.9},"source":"https://github.com/perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6"}],"vanir_signatures_modified":"2026-04-12T04:43:56Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-47038.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}