Perl bug bounty programs
perl.org Updated
Perl runs two public programs: a Sorona bug bounty paying up to $1,500 and a self-hosted bug bounty.
- Top reward
- $1,500
- Sorona
- Programs
- 2
- 2 pay cash
- Targets in scope
- 15
- 4 types, deduplicated
- Last change
- None yet
- Tracked since Nov 2026
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Perl
Sorona · Pays the most of the 2 programs: up to $1,500.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Perl
Sorona · Bug bounty |
– | – | – | $100 (highest) | $1,500 | Partial | – | 3 days promised | Open |
|
Perl
Self-hosted · Bug bounty |
– | – | – | – | Not published | None | – | – | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100 (highest)
- Safe harbor
- Partial
- First response
- 3 days promised
-
- Safe harbor
- None
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
15 targets across all 2 programs, each listed once with the programs that cover it. 6 excluded.
-
sprintf, pack and unpack and the format-string machinery, which parse a specification and then write memory according to it
Products and areas
Covered by Sorona
-
Storable deserialisation and every other core path that reconstructs a Perl data structure from bytes
Products and areas
Covered by Sorona
-
String and buffer handling across the C source, the historical home of this project's heap overflows
Products and areas
Covered by Sorona
-
Taint mode and the checks it is supposed to enforce, plus setuid-adjacent behaviour
Products and areas
Covered by Sorona
-
The build and installation tooling the core ships, ExtUtils::MakeMaker among it
Products and areas
Covered by Sorona
-
The core modules the distribution ships, including Storable, Data::Dumper, File::Spec, IPC::Open3, Socket and the POSIX bindings
Products and areas
Covered by Sorona
-
The interpreter core: the tokenizer, the optree builder, the runtime ops and the reference counting underneath them
Products and areas
Covered by Sorona
-
The regular-expression engine end to end, from pattern compilation through matching, including recursion, backtracking and the Unicode property machinery
Products and areas
Covered by Sorona
-
The security policy asks for any security issue in perl5 privately on the security list and states plainly that there is no money for it. It declares no component boundary, so the perl interpreter and the modules the core distribution ships are the target
Products and areas
Covered by Sorona
-
The XS boundary and the C API that extensions use, where an interpreter invariant can be violated from outside
Products and areas
Covered by Sorona
-
Unicode and encoding handling, covering Encode, UTF-8 validation and the conversions between internal string representations
Products and areas
Covered by Sorona
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
CPAN modules outside the core distribution, which belong to their own authors
Sorona
-
Distribution packaging and distro-specific patches rather than upstream perl5
Sorona
-
Perl programs with injection bugs of their own, as distinct from a defect in the interpreter
Sorona
-
Reports sent anywhere other than the security list, which puts them outside the documented embargo process
Sorona
-
Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary
Sorona
-
Running untrusted Perl source deliberately. The language ships no sandbox and claims none
Sorona
Recent changes
Reward and scope changes across every Perl program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Perl products, from the NVD.
-
CVE-2026-57432 High
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @,
-
CVE-2026-57432 High
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @,
-
CVE-2026-13221 Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above
-
CVE-2026-13221 Critical
Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above
-
CVE-2026-14380 High
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code exe
-
CVE-2026-14739 Critical
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.
-
CVE-2026-14739 Critical
DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders.
-
CVE-2026-14380 High
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code exe
About this page
This page gathers every public program listed under perl.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.