critical 9.8

CVE-2018-18311 in the critical feed json

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

published 2018-12-07 7y ago modified 2026-06-17 4mo ago also EUVD-2018-10044

cvss: 9.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 11.7%; EPSS 11.7% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

Patch / fix

fixed in 3 distros 6 links 2

perl perl 5.26.3, 5.28.1
mcafee web_gateway 7.7.2.21, 7.8.2.8, 8.1.1
apple mac_os_x 10.14.4

debian ubuntu red hat suse opensuse alpine

perl Debian 14, Debian 13, Debian 12 5.28.1-1

debian advisories DEBIAN-CVE-2018-18311

perl Ubuntu 14.04 LTS 5.18.2-2ubuntu1.7
perl Ubuntu 16.04 LTS 5.22.1-9ubuntu0.6
perl Ubuntu 18.04 LTS 5.26.1-6ubuntu0.3

ubuntu advisories UBUNTU-CVE-2018-18311

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

perl hummingbird 1 5.42.2-524.1.hum1
perl-B hummingbird 1 1.89-524.1.hum1
perl-if hummingbird 1 0.61.000-524.1.hum1
perl-IO hummingbird 1 1.55-524.1.hum1
perl-ph hummingbird 1 5.42.2-524.1.hum1
perl-lib hummingbird 1 0.65-524.1.hum1
perl-mro hummingbird 1 1.29-524.1.hum1
perl-Net hummingbird 1 1.04-524.1.hum1

red hat advisories RHSA-2026:7604 RHSA-2019:1942 RHSA-2019:2400 RHSA-2019:1790 RHSA-2019:0109 RHSA-2019:0010

perl SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +14 more 5.18.2-12.20.1
perl SLE Module for Development Tools 15, SLE Module for Basesystem 15 5.26.1-7.6.1

suse advisories SUSE-SU-2019:2264-1 SUSE-SU-2018:4187-1

perl openSUSE Tumbleweed 5.34.0-1.1

opensuse advisories openSUSE-SU-2024:11158-1

perl Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 5.26.3-r0
perl Alpine 3.6 5.24.4-r2

alpine advisories ALPINE-CVE-2018-18311

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

github.com/Perl/perl5@34716e2 commit
bugzilla.redhat.com/show_bug.cgi?id=1646730 advisory

Is CVE-2018-18311 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-18311 updated 2026-11-04 cvss 8.1

perl: Integer overflow leading to buffer overflow in Perl_my_setenv()

Red Hat Enterprise Linux 5 perl Red Hat Enterprise Linux 6 perl, perl-CGI, perl-core, perl-CPAN, perl-libs, perl-parent, +39 more Red Hat Virtualization 4 rhvm-appliance, redhat-virtualization-host-image-update
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux Client (v. 7) perl 5.16.3-294.el7_6, perl-core 5.16.3-294.el7_6, perl-CPAN 1.9800-294.el7_6, perl-libs 5.16.3-294.el7_6, perl-IO-Zlib 1.10-294.el7_6, perl-macros 5.16.3-294.el7_6, +10 more Red Hat Enterprise Linux Client Optional (v. 7) perl-tests 5.16.3-294.el7_6 Red Hat Enterprise Linux ComputeNode (v. 7) perl 5.16.3-294.el7_6, perl-core 5.16.3-294.el7_6, perl-CPAN 1.9800-294.el7_6, perl-libs 5.16.3-294.el7_6, perl-IO-Zlib 1.10-294.el7_6, perl-macros 5.16.3-294.el7_6, +10 more
fixed: vendor fix RHSA-2019:0109
Red Hat Enterprise Linux ComputeNode EUS (v. 7.4) perl 5.16.3-292.el7_4.1, perl-core 5.16.3-292.el7_4.1, perl-CPAN 1.9800-292.el7_4.1, perl-libs 5.16.3-292.el7_4.1, perl-IO-Zlib 1.10-292.el7_4.1, perl-macros 5.16.3-292.el7_4.1, +10 more
fixed: vendor fix RHSA-2019:1942
Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) perl 5.16.3-292.el7_5.1, perl-core 5.16.3-292.el7_5.1, perl-CPAN 1.9800-292.el7_5.1, perl-libs 5.16.3-292.el7_5.1, perl-IO-Zlib 1.10-292.el7_5.1, perl-macros 5.16.3-292.el7_5.1, +10 more
fixed: vendor fix RHSA-2019:1790
Red Hat Enterprise Linux ComputeNode Optional (v. 7) perl-tests 5.16.3-294.el7_6
fixed: vendor fix RHSA-2019:0109
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.4) perl-tests 5.16.3-292.el7_4.1
fixed: vendor fix RHSA-2019:1942
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.5) perl-tests 5.16.3-292.el7_5.1
fixed: vendor fix RHSA-2019:1790
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) perl 5.16.3-294.el7_6, perl-core 5.16.3-294.el7_6, perl-CPAN 1.9800-294.el7_6, perl-libs 5.16.3-294.el7_6, perl-IO-Zlib 1.10-294.el7_6, perl-macros 5.16.3-294.el7_6, +10 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) perl-tests 5.16.3-294.el7_6 Red Hat Enterprise Linux Server (v. 7) perl 5.16.3-294.el7_6, perl-core 5.16.3-294.el7_6, perl-CPAN 1.9800-294.el7_6, perl-libs 5.16.3-294.el7_6, perl-IO-Zlib 1.10-294.el7_6, perl-macros 5.16.3-294.el7_6, +10 more
fixed: vendor fix RHSA-2019:0109

show 12 more

Red Hat Enterprise Linux Server AUS (v. 7.3) perl 5.16.3-291.el7_3.1, perl-core 5.16.3-291.el7_3.1, perl-CPAN 1.9800-291.el7_3.1, perl-libs 5.16.3-291.el7_3.1, perl-IO-Zlib 1.10-291.el7_3.1, perl-macros 5.16.3-291.el7_3.1, +10 more Red Hat Enterprise Linux Server E4S (v. 7.3) perl 5.16.3-291.el7_3.1, perl-core 5.16.3-291.el7_3.1, perl-CPAN 1.9800-291.el7_3.1, perl-libs 5.16.3-291.el7_3.1, perl-IO-Zlib 1.10-291.el7_3.1, perl-macros 5.16.3-291.el7_3.1, +10 more
fixed: vendor fix RHSA-2019:2400
Red Hat Enterprise Linux Server EUS (v. 7.4) perl 5.16.3-292.el7_4.1, perl-core 5.16.3-292.el7_4.1, perl-CPAN 1.9800-292.el7_4.1, perl-libs 5.16.3-292.el7_4.1, perl-IO-Zlib 1.10-292.el7_4.1, perl-macros 5.16.3-292.el7_4.1, +10 more
fixed: vendor fix RHSA-2019:1942
Red Hat Enterprise Linux Server EUS (v. 7.5) perl 5.16.3-292.el7_5.1, perl-core 5.16.3-292.el7_5.1, perl-CPAN 1.9800-292.el7_5.1, perl-libs 5.16.3-292.el7_5.1, perl-IO-Zlib 1.10-292.el7_5.1, perl-macros 5.16.3-292.el7_5.1, +10 more
fixed: vendor fix RHSA-2019:1790
Red Hat Enterprise Linux Server Optional (v. 7) perl-tests 5.16.3-294.el7_6
fixed: vendor fix RHSA-2019:0109
Red Hat Enterprise Linux Server Optional AUS (v. 7.3) perl-tests 5.16.3-291.el7_3.1, perl-Perl4-CoreLibs 0.001-291.el7_3.1 Red Hat Enterprise Linux Server Optional E4S (v. 7.3) perl-tests 5.16.3-291.el7_3.1, perl-Perl4-CoreLibs 0.001-291.el7_3.1
fixed: vendor fix RHSA-2019:2400
Red Hat Enterprise Linux Server Optional EUS (v. 7.4) perl-tests 5.16.3-292.el7_4.1
fixed: vendor fix RHSA-2019:1942
Red Hat Enterprise Linux Server Optional EUS (v. 7.5) perl-tests 5.16.3-292.el7_5.1
fixed: vendor fix RHSA-2019:1790
Red Hat Enterprise Linux Server Optional TUS (v. 7.3) perl-tests 5.16.3-291.el7_3.1, perl-Perl4-CoreLibs 0.001-291.el7_3.1 Red Hat Enterprise Linux Server TUS (v. 7.3) perl 5.16.3-291.el7_3.1, perl-core 5.16.3-291.el7_3.1, perl-CPAN 1.9800-291.el7_3.1, perl-libs 5.16.3-291.el7_3.1, perl-IO-Zlib 1.10-291.el7_3.1, perl-macros 5.16.3-291.el7_3.1, +10 more
fixed: vendor fix RHSA-2019:2400
Red Hat Enterprise Linux Workstation (v. 7) perl 5.16.3-294.el7_6, perl-core 5.16.3-294.el7_6, perl-CPAN 1.9800-294.el7_6, perl-libs 5.16.3-294.el7_6, perl-IO-Zlib 1.10-294.el7_6, perl-macros 5.16.3-294.el7_6, +10 more Red Hat Enterprise Linux Workstation Optional (v. 7) perl-tests 5.16.3-294.el7_6
fixed: vendor fix RHSA-2019:0109
Red Hat Hardened Images perl 5.42.2-524.1.hum1, perl-B 1.89-524.1.hum1, perl-IO 1.55-524.1.hum1, perl-Tie 4.6-524.1.hum1, perl-lib 0.65-524.1.hum1, perl-mro 1.29-524.1.hum1, +93 more
fixed: vendor fix RHSA-2026:7604
Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-perl524-perl 5.24.0-381.el6, rh-perl524-perl-IO 1.36-381.el6, rh-perl524-perl-open 1.10-381.el6, rh-perl524-perl-Test 1.28-381.el6, rh-perl524-perl-Errno 1.25-381.el6, rh-perl524-perl-bignum 0.42-381.el6, +22 more Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-perl524-perl 5.24.0-381.el7, rh-perl526-perl 5.26.3-405.el7, rh-perl524-perl-IO 1.36-381.el7, rh-perl526-perl-IO 1.38-405.el7, rh-perl524-perl-open 1.10-381.el7, rh-perl524-perl-Test 1.28-381.el7, +49 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) rh-perl524-perl 5.24.0-381.el7, rh-perl526-perl 5.26.3-405.el7, rh-perl524-perl-IO 1.36-381.el7, rh-perl526-perl-IO 1.38-405.el7, rh-perl524-perl-open 1.10-381.el7, rh-perl524-perl-Test 1.28-381.el7, +49 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) rh-perl524-perl 5.24.0-381.el7, rh-perl526-perl 5.26.3-405.el7, rh-perl524-perl-IO 1.36-381.el7, rh-perl526-perl-IO 1.38-405.el7, rh-perl524-perl-open 1.10-381.el7, rh-perl524-perl-Test 1.28-381.el7, +49 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) rh-perl524-perl 5.24.0-381.el7, rh-perl526-perl 5.26.3-405.el7, rh-perl524-perl-IO 1.36-381.el7, rh-perl526-perl-IO 1.38-405.el7, rh-perl524-perl-open 1.10-381.el7, rh-perl524-perl-Test 1.28-381.el7, +49 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-perl524-perl 5.24.0-381.el6, rh-perl524-perl-IO 1.36-381.el6, rh-perl524-perl-open 1.10-381.el6, rh-perl524-perl-Test 1.28-381.el6, rh-perl524-perl-Errno 1.25-381.el6, rh-perl524-perl-bignum 0.42-381.el6, +22 more

+1 more productsfewer

Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-perl524-perl 5.24.0-381.el7, rh-perl526-perl 5.26.3-405.el7, rh-perl524-perl-IO 1.36-381.el7, rh-perl526-perl-IO 1.38-405.el7, rh-perl524-perl-open 1.10-381.el7, rh-perl524-perl-Test 1.28-381.el7, +49 more

fixed: vendor fix RHSA-2019:0010
Red Hat Enterprise Linux 8 perl, perl-IO, perl-libs, perl-open, perl-Test, perl-Errno, +19 more Red Hat OpenShift Enterprise 3 perl
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

11.68% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-787 Out-of-bounds Write

References

github.com /Perl/perl5/commit/34716e2a6ee2af96078d62b065b7785c001194be
patch, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1646730
issue-tracking, patch, third-party-advisory
debian.org /security/2018/dsa-4347
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:0010
vendor-advisory, third-party-advisory
usn.ubuntu.com /3834-2/
vendor-advisory, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM/
vendor-advisory
access.redhat.com /errata/RHSA-2019:0001
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:0109
vendor-advisory, third-party-advisory
usn.ubuntu.com /3834-1/
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHBA-2019:0327
vendor-advisory, third-party-advisory
access.redhat.com /errata/RHSA-2019:1790
vendor-advisory
access.redhat.com /errata/RHSA-2019:1942
vendor-advisory
access.redhat.com /errata/RHSA-2019:2400
vendor-advisory
security.gentoo.org /glsa/201909-01
vendor-advisory
lists.debian.org /debian-lts-announce/2018/11/msg00039.html
mailing-list, third-party-advisory
securityfocus.com /bid/106145
vdb-entry, third-party-advisory
securitytracker.com /id/1042181
vdb-entry, third-party-advisory
seclists.org /bugtraq/2019/Mar/42
mailing-list, third-party-advisory
seclists.org /fulldisclosure/2019/Mar/49
mailing-list, third-party-advisory
oracle.com /security-alerts/cpuapr2020.html
oracle.com /security-alerts/cpujul2020.html
oracle.com /technetwork/security-advisory/cpujul2019-5072835.html
support.apple.com /kb/HT209600
third-party-advisory
security.netapp.com /advisory/ntap-20190221-0003/
third-party-advisory
metacpan.org /changes/release/SHAY/perl-5.26.3
third-party-advisory
metacpan.org /changes/release/SHAY/perl-5.28.1
third-party-advisory
rt.perl.org /Ticket/Display.html?id=133204
issue-tracking, third-party-advisory
kc.mcafee.com /corporate/index?page=content&id=SB10278
third-party-advisory

Sources

CVE List CVE-2018-18311
NVD CVE-2018-18311

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.