Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-77781— Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys

Quick assessment

Affected
CVE-2026-77781
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Perl 的 Tie::Hash::Regex 模块在 2.0.0 版本之前，会在尝试使用无法解析的查找键（lookup keys）时抛出异常。 当正则表达式格式不正确时，FETCH、EXISTS 和 DELETE 方法均会抛出异常。 在键尚未存储在哈希中时，上述每个方法都会回退到正则表达式匹配：它将调用者提供的键与裸正则表达式 进行编译，且未使用任何 保护机制。如果键不是有效的正则表达式模式（例如，包含未闭合的方括号），程序将直接死亡（die）。 因此，如果应用程序在绑定哈希中查找外部传入的字符串，当遇到无效的键

AI Predicted 5.3 Difficulty: Easy EPSS 0.24% · P15

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 2.0.0 affected

I. Basic Information for CVE-2026-77781

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys
Source: CVE Program / CVE List V5
Vulnerability Description
Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the caller's key with a bare qr// and no eval guard. A key that is not a valid regular expression pattern, such as a single unmatched bracket, dies. An application that looks up externally supplied strings in a tied hash will die on an invalid key.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
未捕获的异常
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 2.0.0 -

II. Public POCs for CVE-2026-77781

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-77781

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-77781 (1)

Vendor Pages for CVE-2026-77781 (1)

IV. Related Vulnerabilities

Same weakness: CWE-248

V. Comments for CVE-2026-77781

No comments yet

Leave a comment