{"id":"CVE-2026-8796","summary":"Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input","details":"Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input.\n\nIn Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash() process a COPY tag, a back-reference whose target byte the decoder re-decodes as a fresh tag. When that target byte matches the SHORT_BINARY pattern (an inline string whose length is encoded in the low bits of the tag), the resulting read is not bounded to precede the COPY tag's own offset and can run past the end of the input buffer. An attacker controlled COPY offset can land inside a previously decoded value rather than on a tag boundary, planting a byte that the decoder reads as a SHORT_BINARY tag and consuming up to 31 following bytes from the heap as a class name (OBJECT path) or hash key (HASH path).","modified":"2026-08-12T16:09:29.061095Z","published":"2026-05-31T19:43:22.054Z","related":["openSUSE-SU-2026:10924-1"],"database_specific":{"cna_assigner":"CPANSec","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8796.json"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/06/01/1"},{"type":"WEB","url":"https://cpan.org/modules"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8796.json"},{"type":"ADVISORY","url":"https://metacpan.org/release/YVES/Sereal-Decoder-5.005/changes"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8796"},{"type":"FIX","url":"https://github.com/Sereal/Sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3.patch"},{"type":"PACKAGE","url":"https://github.com/Sereal/Sereal"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/sereal/sereal","events":[{"introduced":"0"},{"fixed":"303a2c69cdba80bf37a3ff43461e0aa78198a7a3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"5.005"}],"source":["AFFECTED_FIELD","DESCRIPTION","REFERENCES"]}}],"versions":["Sereal-Encoder-5.004_001","Sereal-Decoder-5.004_001","Sereal-5.004_001","Sereal-Encoder-5.004","Sereal-Decoder-5.004","Sereal-5.004","Sereal-Encoder-5.003","Sereal-Decoder-5.003","Sereal-5.003","Sereal-Encoder-5.002_002","Sereal-Decoder-5.002_002","Sereal-5.002_002","Sereal-Encoder-5.002_001","Sereal-Decoder-5.002_001","Sereal-5.002_001","Sereal-Encoder-5.002","Sereal-Decoder-5.002","Sereal-5.002","Sereal-Encoder-5.001_003","Sereal-Decoder-5.001_003","Sereal-5.001_003","Sereal-Encoder-5.001_002","Sereal-Decoder-5.001_002","Sereal-5.001_002","Sereal-Encoder-5.001_001","Sereal-Decoder-5.001_001","Sereal-5.001_001","Sereal-Encoder-5.001","Sereal-Decoder-5.001","Sereal-5.001","Sereal-Encoder-5.000_002","Sereal-Decoder-5.000_002","Sereal-5.000_002","Sereal-Encoder-5.000_001","Sereal-Decoder-5.000_001","Sereal-5.000_001","Sereal-Encoder-4.025","Sereal-Decoder-4.025","Sereal-4.025","Sereal-Encoder-4.024","Sereal-Decoder-4.024","Sereal-4.024","Sereal-Encoder-4.023","Sereal-Decoder-4.023","Sereal-4.023","Sereal-Encoder-4.022","Sereal-Decoder-4.022","Sereal-4.022","Sereal-Encoder-4.021","Sereal-Decoder-4.021","Sereal-4.021","Sereal-Encoder-4.020","Sereal-Decoder-4.020","Sereal-4.020","Sereal-Encoder-4.019","Sereal-Decoder-4.019","Sereal-4.019","Sereal-Java-0.0.5","Sereal-Encoder-4.018","Sereal-Decoder-4.018","Sereal-4.018","Sereal-Encoder-4.017_001","Sereal-Decoder-4.017_001","Sereal-4.017_001","Sereal-Java-0.0.4","Sereal-Encoder-4.017","Sereal-Decoder-4.017","Sereal-4.017","Sereal-Encoder-4.016","Sereal-Decoder-4.016","Sereal-4.016","Sereal-Encoder-4.015","Sereal-Decoder-4.015","Sereal-4.015","Sereal-Encoder-4.014","Sereal-Decoder-4.014","Sereal-4.014","Sereal-Encoder-4.012","Sereal-Decoder-4.012","Sereal-4.012","Sereal-Encoder-4.011","Sereal-Decoder-4.011","Sereal-4.011","Sereal-Encoder-4.010","Sereal-Decoder-4.010","Sereal-4.010","Sereal-Encoder-4.009_003","Sereal-Decoder-4.009_003","Sereal-4.009_003","Sereal-Encoder-4.009_002","Sereal-Decoder-4.009_002","Sereal-4.009_002","Sereal-Encoder-4.009_001","Sereal-Decoder-4.009_001","Sereal-4.009_001","Sereal-Encoder-4.009","Sereal-Decoder-4.009","Sereal-4.009","Sereal-Encoder-4.008","Sereal-Decoder-4.008","Sereal-4.008","Sereal-Encoder-4.007_001","Sereal-Decoder-4.007_001","Sereal-4.007_001","v1.0","Python-Encoder-v1.0","Sereal-Encoder-4.007","Sereal-Decoder-4.007","Sereal-4.007","Sereal-Encoder-4.006","Sereal-Decoder-4.006","Sereal-4.006","Sereal-Encoder-4.005","Sereal-Decoder-4.005","Sereal-4.005","Sereal-Path-4.004","Sereal-Encoder-4.004","Sereal-Decoder-4.004","Sereal-4.004","Sereal-Encoder-4.003","Sereal-Decoder-4.003","Sereal-4.003","Sereal-Encoder-4.002","Sereal-Decoder-4.002","Sereal-4.002","Sereal-Path-4.003","Sereal-Path-4.002","Sereal-Path-4.001_004","Sereal-Encoder-4.001_003","Sereal-Decoder-4.001_003","Sereal-4.001_003","Sereal-Encoder-4.001_002","Sereal-Decoder-4.001_002","Sereal-4.001_002","Sereal-Path-4.001_002","Sereal-Path-4.001_001","Sereal-Path-0.014","Sereal-Encoder-4.001_001","Sereal-Decoder-4.001_001","Sereal-4.001_001","Sereal-Encoder-3.015","Sereal-Decoder-3.015","Sereal-3.015","Sereal-Encoder-3.014_002","Sereal-Decoder-3.014_002","Sereal-3.014_002","Sereal-Encoder-3.014_001","Sereal-Decoder-3.014_001","Sereal-3.014_001","Sereal-Path-0.013","Sereal-Encoder-3.014","Sereal-Decoder-3.014","Sereal-3.014","Sereal-Encoder-3.012","Sereal-Decoder-3.012","Sereal-3.012","Sereal-Encoder-3.011","Sereal-Decoder-3.011","Sereal-3.011","Sereal-Encoder-3.010","Sereal-Decoder-3.010","Sereal-3.010","Sereal-Encoder-3.009","Sereal-Decoder-3.009","Sereal-3.009","Sereal-Encoder-3.008","Sereal-Decoder-3.008","Sereal-3.008","Sereal-Encoder-3.007","Sereal-Decoder-3.007","Sereal-3.007","Sereal-Encoder-3.006_007","Sereal-Decoder-3.006_007","Sereal-3.006_007","Sereal-Encoder-3.006_006","Sereal-Decoder-3.006_006","Sereal-3.006_006","Sereal-Encoder-3.006_005","Sereal-Decoder-3.006_005","Sereal-3.006_005","Sereal-Encoder-3.006_004","Sereal-Decoder-3.006_004","Sereal-3.006_004","Sereal-Encoder-3.006_003","Sereal-Decoder-3.006_003","Sereal-3.006_003","Sereal-Encoder-3.006_002","Sereal-Decoder-3.006_002","Sereal-3.006_002","Sereal-Encoder-3.006_001","Sereal-Decoder-3.006_001","Sereal-3.006_001","Sereal-Encoder-3.006","Sereal-Decoder-3.006","Sereal-3.006","Sereal-Encoder-3.005_005","Sereal-Decoder-3.005_005","Sereal-3.005_005","Sereal-Encoder-3.005_004","Sereal-Decoder-3.005_004","Sereal-3.005_004","Sereal-Encoder-3.005_003","Sereal-Decoder-3.005_003","Sereal-3.005_003","Sereal-Path-0.011","Sereal-Encoder-3.005_002","Sereal-Decoder-3.005_002","Sereal-3.005_002","Sereal-Path-0.010","Sereal-Path-0.009","Sereal-Path-0.008","Sereal-Path-0.007","Sereal-Path-0.004","Sereal-Path-0.003","Sereal-Path-0.002","Sereal-Path-0.001","Sereal-Merger-0.001","Sereal-Encoder-3.005_001","Sereal-Decoder-3.005_001","Sereal-3.005_001","Sereal-Encoder-3.005","Sereal-Decoder-3.005","Sereal-3.005","Sereal-Encoder-3.004","Sereal-Decoder-3.004","Sereal-3.004","Sereal-Encoder-3.003_004","Sereal-Decoder-3.003_004","Sereal-3.003_004","Sereal-Encoder-3.003_003","Sereal-Decoder-3.003_003","Sereal-3.003_003","Sereal-Encoder-3.003_002","Sereal-Decoder-3.003_002","Sereal-3.003_002","Sereal-Encoder-3.003_001","Sereal-Decoder-3.003_001","Sereal-3.003_001","Sereal-Encoder-3.003","Sereal-Decoder-3.003","Sereal-3.003","Sereal-Encoder-3.002_002","Sereal-Decoder-3.002_002","Sereal-3.002_002","Sereal-Encoder-3.002_001","Sereal-Decoder-3.002_001","Sereal-3.002_001","Sereal-Encoder-3.002","Sereal-Decoder-3.002","Sereal-3.002","Sereal-Encoder-3.001_012","Sereal-Decoder-3.001_012","Sereal-3.001_012","Sereal-Encoder-3.001_011","Sereal-Decoder-3.001_011","Sereal-3.001_011","Sereal-Encoder-3.001_009","Sereal-Decoder-3.001_009","Sereal-3.001_009","Sereal-Encoder-3.001_008","Sereal-Decoder-3.001_008","Sereal-3.001_008","Sereal-Encoder-3.001_007","Sereal-Decoder-3.001_007","Sereal-3.001_007","Sereal-Encoder-3.001_006","Sereal-Decoder-3.001_006","Sereal-3.001_006","Sereal-Encoder-3.001_005","Sereal-Decoder-3.001_005","Sereal-3.001_005","Sereal-Encoder-3.001_004","Sereal-Decoder-3.001_004","Sereal-3.001_004","Sereal-Encoder-3.001_003","Sereal-Decoder-3.001_003","Sereal-3.001_003","Sereal-Encoder-3.001_002","Sereal-Decoder-3.001_002","Sereal-3.001_002","Sereal-Encoder-3.001_001","Sereal-Decoder-3.001_001","Sereal-3.001_001","Sereal-Encoder-3.001","Sereal-Decoder-3.001","Sereal-3.001","Sereal-Encoder-3.000_004","Sereal-Decoder-3.000_004","Sereal-3.000_004","Sereal-Encoder-3.000_003","Sereal-Decoder-3.000_003","Sereal-3.000_003","Sereal-Encoder-3.000_002","Sereal-Decoder-3.000_002","Sereal-3.000_002","Sereal-Encoder-3.000_001","Sereal-Decoder-3.000_001","Sereal-3.000_001","Sereal-Encoder-2.12","Sereal-Decoder-2.12","Sereal-2.12","Sereal-Encoder-2.11","Sereal-Decoder-2.11","Sereal-2.11","Sereal-Encoder-2.10","Sereal-Decoder-2.10","Sereal-2.10","Sereal-Encoder-2.09","Sereal-Decoder-2.09","Sereal-2.09","Sereal-Encoder-2.08","Sereal-Decoder-2.08","Sereal-2.08","Sereal-Encoder-2.070_103","Sereal-Decoder-2.070_103","Sereal-2.070_103","Sereal-Encoder-2.070_102","Sereal-Decoder-2.070_102","Sereal-2.070_102","Sereal-Encoder-2.070_101","Sereal-Decoder-2.070_101","Sereal-2.070_101","Sereal-Encoder-2.07_01","Sereal-Decoder-2.07_01","Sereal-2.060","Sereal-Encoder-2.06","Sereal-Decoder-2.06","Sereal-Encoder-2.04","Sereal-Decoder-2.04","Sereal-2.040","Sereal-2.030","Sereal-Encoder-2.03","Sereal-Decoder-2.03","Sereal-2.020","Sereal-Encoder-2.02","Sereal-Decoder-2.02","Sereal-2.011","Sereal-Encoder-2.01","Sereal-Decoder-2.01","Sereal-2.010","Sereal-Encoder-2.00_03","Sereal-Decoder-2.00_03","Sereal-Encoder-2.00_02","Sereal-Decoder-2.00_02","Sereal-Encoder-2.00_01","Sereal-Decoder-2.00_01","Sereal-Encoder-0.36","Sereal-Decoder-0.36","Sereal-0.360","Sereal-Encoder-0.35","Sereal-Decoder-0.35","Sereal-0.350","Sereal-Encoder-0.34","Sereal-Decoder-0.34","Sereal-0.340","Sereal-Encoder-0.33","Sereal-Decoder-0.33","Sereal-0.330","Sereal-Encoder-0.32","Sereal-Decoder-0.32","Sereal-0.320","Sereal-Encoder-0.31","Sereal-Decoder-0.31","Sereal-0.310","Sereal-Encoder-0.30","Sereal-Decoder-0.30","Sereal-0.300","Sereal-Encoder-0.29","Sereal-Decoder-0.29","Sereal-0.290","Sereal-Encoder-0.28","Sereal-Decoder-0.28","Sereal-0.280","Sereal-Encoder-0.27","Sereal-Decoder-0.27","Sereal-0.270","Sereal-0.260","Sereal-Encoder-0.26","Sereal-Encoder-0.25","Sereal-Decoder-0.25","Sereal-0.250","Sereal-Decoder-0.24","Sereal-0.230","Sereal-Encoder-0.23","Sereal-Decoder-0.23","Sereal-0.210","Sereal-Decoder-0.21","Sereal-0.201","Sereal-0.20","Sereal-Encoder-0.20","Sereal-Decoder-0.19","Sereal-Encoder-0.18","Sereal-Encoder-0.17","Sereal-Encoder-0.16","Sereal-Encoder-0.15","Sereal-Decoder-0.15","Sereal-Encoder-0.14","Sereal-Decoder-0.13","Sereal-Encoder-0.12","Sereal-Encoder-0.11","Sereal-Decoder-0.11","Sereal-Encoder-0.10","Sereal-Decoder-0.10","Sereal-Encoder-0.09","Sereal-Decoder-0.09","Sereal-Encoder-0.08","Sereal-Decoder-0.08","Sereal-Encoder-0.07","Sereal-Decoder-0.07","Sereal-Encoder-0.06","Sereal-Decoder-0.06","Sereal-Encoder-0.05","Sereal-Decoder-0.05","Sereal-Encoder-0.04","Sereal-Decoder-0.04","Sereal-Encoder-0.03","Sereal-Decoder-0.03","Sereal-Encoder-0.02","Sereal-Decoder-0.02","Sereal-Encoder-0.01","Sereal-Decoder-0.01"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8796.json","vanir_signatures_modified":"2026-08-12T16:09:29Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["61381407242029131695978561178972012303","11174668865330703112576829627949589207","190537357510444417507124154990956405414","297146153376131249972539612298566988210","289585766490880575911396053189985162262","163308288594344713124863464176948439099","124536524136588393490295496665578922989","171221493957253183738375537050742397713","268310556914793692844301389941838017381","258267033315715235024694084858524379373","67304895398874801408864706046839838","240296414773776985092567041298606134287","55305459223060507320473980221222639402","97980155604397822929736861714905506783","331309168150697357603560450597232372572","235217880045546595289094840910897935330","290038493599228016504896436410203116574","105462432780387263988385037600845357146","257493725135150005475845858875159812739","157180675692545978703099722822217306540","89524370887479435900709638500973557218","224991911875216117742371300084313710098","282455431135805132572043630752472851630","292111710989613816510700075550349951277","21428734440626120041451487069401775301","5746246355084834192203179930470595454","298525831711396534796070539571323843599","277736926610526831292273019639024786917","129908480082564900657538452253220049496","131772278036072530593036482568071637259","109861804317522455710701073638206654303","64337703692898020878049423299456514289","77769996003057535070366256993858986321","87052427473664425504148633733438787685","287031940801358253978847052447933259647","320547964412545909496420745527587336123","140743455897721311927630590044766802384","12736150034141022415080823179269638158","331309168150697357603560450597232372572","235217880045546595289094840910897935330","290038493599228016504896436410203116574","60445275511673664265457131534968995468","99915681495934687505937096979975743425","38287912136348878657626929596636061570","325703181791191693454177154410642952983","134550833102022254698132297874966385479","96541274912085592707564474820019892805","244377732259532760649936572583031769995","45592522871221164690104008540465952561","64714385585000203830565016395447665960","76845268366795368302430935613438108142","325083452345431784653788130306345061473","218293037862926711718987791043959287034","294534543855496623413732281530268798687","177308136539758912912186611213088735094","42005938051727069476352050585947511172","112260663146393169393578690361897499029","201684826816454864187267112448932528104","200007414964189701841910914241189147623","129912435506126599256844598279776913587","122966387972867850144707138057077433534"],"threshold":0.9},"id":"CVE-2026-8796-22260ffd","signature_type":"Line","signature_version":"v1","source":"https://github.com/sereal/sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3","target":{"file":"Perl/Decoder/srl_decoder.c"}},{"id":"CVE-2026-8796-78f0cdd4","signature_type":"Function","signature_version":"v1","source":"https://github.com/sereal/sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3","target":{"file":"Perl/Decoder/srl_decoder.c","function":"srl_read_hash"},"deprecated":false,"digest":{"function_hash":"189020112111499868726319035142174377927","length":3236}},{"signature_version":"v1","source":"https://github.com/sereal/sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3","target":{"file":"Perl/Decoder/srl_decoder.c","function":"srl_read_copy"},"deprecated":false,"digest":{"length":641,"function_hash":"112774017181973440815046938953888645873"},"id":"CVE-2026-8796-c191c9f2","signature_type":"Function"},{"deprecated":false,"digest":{"length":3126,"function_hash":"204892237711124052809831330492608025093"},"id":"CVE-2026-8796-e04cba59","signature_type":"Function","signature_version":"v1","source":"https://github.com/sereal/sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3","target":{"file":"Perl/Decoder/srl_decoder.c","function":"srl_read_object"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H"}]}