{"id":"UBUNTU-CVE-2026-126673","details":"Data::Dump::Streamer versions before 3.00 for Perl allow code injection via unescaped Regexp patterns in _dump_qr. A Regexp's pattern is written into a qr literal without escaping \"$\" or \"@\", so \"@{[ ... ]}\" and \"${\\ ... }\" in the pattern run as code when the dump is evaluated. An already escaped delimiter gets a second backslash, which leaves the delimiter bare and ends the qr literal early. An attacker who supplies a pattern that an application compiles, dumps and later restores with eval or do can run arbitrary Perl code.","modified":"2026-11-12T23:46:40.259453590Z","published":"2026-11-12T00:00:00Z","upstream":["CVE-2026-126673"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-126673"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-126673"},{"type":"REPORT","url":"https://lists.security.metacpan.org/cve-announce/msg/45080681/"},{"type":"REPORT","url":"https://metacpan.org/release/YVES/Data-Dump-Streamer-3.00/source/Changes"},{"type":"REPORT","url":"http://www.openwall.com/lists/oss-security/2026/11/12/2"}],"affected":[{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/libdata-dump-streamer-perl?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.38-2","2.39-2"],"ecosystem_specific":{"binaries":[{"binary_name":"libdata-dump-streamer-perl","binary_version":"2.39-2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/libdata-dump-streamer-perl?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libdata-dump-streamer-perl","binary_version":"2.40-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/libdata-dump-streamer-perl?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40-1build2","2.40-1build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libdata-dump-streamer-perl","binary_version":"2.40-1build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/libdata-dump-streamer-perl?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.40-1build4","2.40-1build5"],"ecosystem_specific":{"binaries":[{"binary_name":"libdata-dump-streamer-perl","binary_version":"2.40-1build5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/libdata-dump-streamer-perl?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-1","2.42-1build1","2.42-2","2.42-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"libdata-dump-streamer-perl","binary_version":"2.42-2build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Ubuntu:26.10","purl":"pkg:deb/ubuntu/libdata-dump-streamer-perl?arch=source&distro=stonking"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-2build2","2.42-2build3"],"ecosystem_specific":{"binaries":[{"binary_name":"libdata-dump-streamer-perl","binary_version":"2.42-2build3"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126673.json"}},{"package":{"name":"libdata-dump-streamer-perl","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/libdata-dump-streamer-perl?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.42-2build2"],"ecosystem_specific":{"binaries":[{"binary_name":"libdata-dump-streamer-perl","binary_version":"2.42-2build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-126673.json"}}],"schema_version":"1.9.2","severity":[{"type":"Ubuntu","score":"medium"}]}