CVE-2020-12723 @ Saiph

"CVE-2020-12723"
"perl-5.28.1-6+deb10u1"
"perl-base-5.28.1-6+deb10u1"
"perl-modules-5.20.2-3+deb8u7"
"perl-modules-5.24-5.24.1-3+deb9u5"
"perl-modules-5.28-5.28.1-6+deb10u1"
"libalgorithm-diff-perl-1.19.03-2"
"libalgorithm-diff-xs-perl-0.04-5+b1"
"libalgorithm-merge-perl-0.08-3"
"libbit-vector-perl-7.4-1+b5"
"libcarp-clan-perl-6.07-1"
"libcgi-fast-perl-1:2.13-1"
"libcgi-pm-perl-4.40-1"
"libconfig-inifiles-perl-3.000001-1"
"libdate-calc-perl-6.4-1"
"libdate-calc-xs-perl-6.4-1+b4"
"libdate-manip-perl-6.76-1"
"Am I vulnerable?"

Status

new

Priority

0.62

Match score

4.0

Risk

DoS Remote

CVSS

7.5 HIGH

Reason

cpe: perl; pkgs: perl; version: in-range: perl-5.28.1-6+deb10u1, perl-base-5.28.1-6+deb10u1, perl-modules-5.20.2-3+deb8u7, perl-modules-5.24-5.24.1-3+deb9u5, perl-modules-5.28-5.28.1-6+deb10u1; risk:dos

Created

2026-10-15T10:20:43Z

Updated

2026-10-20T10:18:51Z

Package interrogation (copy)

Run on the host — click to copy a command. Debian/apt

Package	Commands
perl-5.28.1-6+deb10u1
perl-base-5.28.1-6+deb10u1
perl-modules-5.20.2-3+deb8u7
perl-modules-5.24-5.24.1-3+deb9u5
perl-modules-5.28-5.28.1-6+deb10u1
libalgorithm-diff-perl-1.19.03-2
libalgorithm-diff-xs-perl-0.04-5+b1
libalgorithm-merge-perl-0.08-3
libbit-vector-perl-7.4-1+b5
libcarp-clan-perl-6.07-1
libcgi-fast-perl-1:2.13-1
libcgi-pm-perl-4.40-1
libconfig-inifiles-perl-3.000001-1
libdate-calc-perl-6.4-1
libdate-calc-xs-perl-6.4-1+b4
libdate-manip-perl-6.76-1
libdbd-mysql-perl-4.050-2
libdbi-perl-1.642-1+deb10u2
libdpkg-perl-1.19.8
libencode-locale-perl-1.05-1
liberror-perl-0.17027-2
libfcgi-perl-0.78-2+b3
libfile-fcntllock-perl-0.22-3+b5
libfile-tail-perl-1.3-5
libhtml-parser-perl-3.72-3+b3
libhtml-tagset-perl-3.20-3
libhtml-template-perl-2.97-1
libhttp-date-perl-6.02-1
libhttp-message-perl-6.18-1
libio-html-perl-1.001-1
liblocale-gettext-perl-1.07-3+b4
liblwp-mediatypes-perl-6.02-1
libmodule-build-perl-0.422000-1
libperl5.28-5.28.1-6+deb10u1
libpod-latex-perl-0.61-2

Inventory lookup

Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.

Suggestions: perl · perl-base · perl-modules

System	Matches	Ticket for CVE-2020-12723
Archive	perl-base 5.28.1-6+deb10u1	new open
Janus	perl-base 5.28.1-6+deb10u1	new open
Library	perl-base 5.24.1-3+deb9u7	new open
Saiph	perl-base 5.28.1-6+deb10u1	new open
Bullseye	perl-base 5.32.1-4+deb11u5	none
Helios	perl-base 5.32.1-4+deb11u5	none
Matrix	perl-base 5.36.0-7+deb12u4	none
Silk	perl-base 5.36.0-7+deb12u4	none

Related CVE (same fix)

Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.

Host OS / kernel

Debian GNU/Linux 10 (buster) (10) · debian

Arch

x86_64

kernel_release

uname -r → 4.19.0-27-amd64

kernel_version

uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)

For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.

Same CVE on other hosts

Open the ticket for this CVE on another system.

System	Status	Priority	Updated
morris	new	7.0	2026-10-20T10:18:51Z	Open
mufasa	new	7.0	2026-10-20T10:18:51Z	Open
Library	new	1.75	2026-10-20T10:18:51Z	Open
Archive	new	0.62	2026-10-20T10:18:51Z	Open
Janus	new	0.62	2026-10-20T10:18:51Z	Open

Description

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

Update status

Add note only

References

NVD: CVE-2020-12723