CVE-2026-14895

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14895", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-06T18:31:10.251Z", "datePublished": "2026-07-07T22:12:22.460Z", "dateUpdated": "2026-07-08T14:05:18.813Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "String-Util", "product": "String::Util", "programFiles": ["lib/String/Util.pm"], "programRoutines": [{"name": "String::Util::trim"}, {"name": "String::Util::rtrim"}], "repo": "https://github.com/scottchiefbaker/String-Util", "vendor": "BAKERSCOT", "versions": [{"lessThan": "1.36", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.\n\nThe trim and rtrim functions stripped trailing whitespace with s/\\s*$//u. Because \\s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \\s*$ with \\s+$.\n\nAny caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-07T22:12:22.460Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/scottchiefbaker/String-Util/commit/f8150867aaeb8f57c59601aefb2193f2caed8745.patch"}, {"url": "https://metacpan.org/release/BAKERSCOT/String-Util-1.36/diff/BAKERSCOT/String-Util-1.35#lib/String/Util.pm"}, {"tags": ["release-notes"], "url": "https://github.com/scottchiefbaker/String-Util/releases"}], "solutions": [{"lang": "en", "value": "Upgrade to version 1.36 or later."}], "source": {"discovery": "UNKNOWN"}, "title": "String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, enforce a maximum length on strings before passing them to the trim and rtrim functions.\n\nNote that the HTML form field maxlength attribute is only enforced client-side."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/07/18"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-08T00:28:33.750Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T14:05:12.698100Z", "id": "CVE-2026-14895", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T14:05:18.813Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/07/18"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-08T00:28:33.750Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-14895", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-08T14:05:12.698100Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T14:04:34.545Z"}}], "cna": {"title": "String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/scottchiefbaker/String-Util", "vendor": "BAKERSCOT", "product": "String::Util", "versions": [{"status": "affected", "version": "0", "lessThan": "1.36", "versionType": "custom"}], "packageName": "String-Util", "programFiles": ["lib/String/Util.pm"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "String::Util::trim"}, {"name": "String::Util::rtrim"}]}], "solutions": [{"lang": "en", "value": "Upgrade to version 1.36 or later."}], "references": [{"url": "https://github.com/scottchiefbaker/String-Util/commit/f8150867aaeb8f57c59601aefb2193f2caed8745.patch", "tags": ["patch"]}, {"url": "https://metacpan.org/release/BAKERSCOT/String-Util-1.36/diff/BAKERSCOT/String-Util-1.35#lib/String/Util.pm"}, {"url": "https://github.com/scottchiefbaker/String-Util/releases", "tags": ["release-notes"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade, enforce a maximum length on strings before passing them to the trim and rtrim functions.\n\nNote that the HTML form field maxlength attribute is only enforced client-side."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.\n\nThe trim and rtrim functions stripped trailing whitespace with s/\\s*$//u. Because \\s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \\s*$ with \\s+$.\n\nAny caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1333", "description": "CWE-1333 Inefficient Regular Expression Complexity"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-07T22:12:22.460Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14895", "state": "PUBLISHED", "dateUpdated": "2026-07-08T14:05:18.813Z", "dateReserved": "2026-07-06T18:31:10.251Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-07T22:12:22.460Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "String-Util", "product": "String::Util", "programFiles": ["lib/String/Util.pm"], "programRoutines": [{"name": "String::Util::trim"}, {"name": "String::Util::rtrim"}], "repo": "https://github.com/scottchiefbaker/String-Util", "vendor": "BAKERSCOT", "versions": [{"lessThan": "1.36", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.\n\nThe trim and rtrim functions stripped trailing whitespace with s/\\s*$//u. Because \\s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \\s*$ with \\s+$.\n\nAny caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace."}, {"lang": "es", "value": "Las versiones de String::Util anteriores a la 1.36 para Perl son susceptibles a una denegaci\u00f3n de servicio por expresi\u00f3n regular.\n\nLas funciones trim y rtrim eliminaban los espacios en blanco finales con s/\\s$//u. Debido a que \\s coincide de forma codiciosa y el ancla $ falla cada vez que un car\u00e1cter que no es espacio en blanco sigue al espacio en blanco, el motor de expresiones regulares reintenta la coincidencia en cada desplazamiento de una secuencia larga de espacios en blanco, produciendo un retroceso cuadr\u00e1tico. La soluci\u00f3n reemplaza \\s$ con \\s+$.\n\nCualquier llamador que pase entrada no confiable a trim o rtrim puede desencadenar el agotamiento de la CPU con una cadena que contenga una secuencia larga de espacios en blanco."}], "id": "CVE-2026-14895", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-14895", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T14:05:12.698100Z", "version": "2.0.3"}}]}, "published": "2026-07-07T23:16:54.293", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/scottchiefbaker/String-Util/commit/f8150867aaeb8f57c59601aefb2193f2caed8745.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/scottchiefbaker/String-Util/releases"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/BAKERSCOT/String-Util-1.36/diff/BAKERSCOT/String-Util-1.35#lib/String/Util.pm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/07/18"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1333"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.36)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "String::Util", "source": "cna", "vendor": "BAKERSCOT"}, "product": "string::util", "vendor": "bakerscot"}], "created": "2026-07-08T04:15:04.309358+00:00", "updated": "2026-08-03T05:00:16.015465+00:00", "vendors": ["bakerscot", "bakerscot$PRODUCT$string::util"]}