Perl: Schwachstelle ermöglicht Denial of Service und potentiell Codeausführung
WID-SEC-2025-0791 · first 14.04.2025 · updated 22.05.2026 · CVSS 8,6
What it is about
Perl ist eine freie, plattformunabhängige und interpretierte Programmiersprache (Skriptsprache). Ein Angreifer kann eine Schwachstelle in Perl ausnutzen, um einen Denial of Service zu verursachen und potentiell beliebigen Programmcode auszuführen.
Under what conditions?
The BSI does not name any particular preconditions. Exploitable remotely according to the BSI.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service zu verursachen
- potentiell beliebigen Programmcode auszuführen
Am I affected?
Affected according to the BSI:
- IBM AIX 7.3
- IBM VIOS 4.1
- Red Hat Enterprise Linux
- Fedora Linux
- Ubuntu Linux
- SUSE Linux
- Oracle Linux
- SUSE openSUSE
- Open Source Perl <5.38.4
- Open Source Perl <5.40.2
- IGEL OS <11.11.100
- cPanel cPanel/WHM 128
and 6 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Perl 5.38.4
- Open Source Perl 5.40.2
- IGEL OS 11.11.100
- IGEL OS 12.8.0
- SolarWinds Security Event Manager 2025.2.1
- Dell PowerScale OneFS OneFS 9.10.1.3
- Dell PowerScale OneFS OneFS 9.11.0.1
- NoMachine NoMachine 9.4.14
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- GitHub Advisory Database vom 2025-04-13 github.com
- OSS Security Mailing List vom 2025-04-13 www.openwall.com
- Perl Release Notes vom 2025-04-13 metacpan.org
- Perl Release Notes vom 2025-04-13 metacpan.org
- Fedora Security Advisory FEDORA-2025-11FCC87C66 vom 2025-04-14 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-26C0346398 vom 2025-04-14 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2025-8445F115F6 vom 2025-04-14 bodhi.fedoraproject.org
- Ubuntu Security Notice USN-7434-1 vom 2025-04-14 ubuntu.com
- openSUSE Security Update OPENSUSE-SU-2025:15003-1 vom 2025-04-17 lists.opensuse.org
- Ubuntu Security Notice USN-7434-2 vom 2025-04-23 ubuntu.com
- Red Hat Security Advisory RHSA-2025:7500 vom 2025-05-13 access.redhat.com
- IGEL Security Notice ISN-2025-15 vom 2025-06-23 kb.igel.com
- SUSE Security Update SUSE-SU-2025:20334-1 vom 2025-05-29 lists.suse.com
- cPanel 128 Change Log vom 2025-06-13 docs.cpanel.net
- IBM Security Bulletin 7238159 vom 2025-06-26 www.ibm.com
- Oracle Linux Security Advisory ELSA-2025-7500 vom 2025-06-28 linux.oracle.com
- SEM 2025.2.1 release notes vom 2025-07-02 documentation.solarwinds.com
- SUSE Security Update SUSE-SU-2025:20532-1 vom 2025-08-05 lists.suse.com
- Dell Security Advisory DSA-2025-272 vom 2025-08-06 www.dell.com
- NoMachine Release Notes vom 2026-03-26 kb.nomachine.com
- cPanel & WHM Change Log vom 2026-05-21 docs.cpanel.net
CVE: CVE-2024-56406
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.