- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 3 days
The team commits to an initial response within 72 hours and runs a documented embargo process from there
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
- Hall of fame
-
Yes
The only thing offered is public credit in the release announcement.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 6 excluded.
Web 1
- https://www.perl.org
Products and areas 11
- sprintf, pack and unpack and the format-string machinery, which parse a specification and then write memory according to it
- Storable deserialisation and every other core path that reconstructs a Perl data structure from bytes
- String and buffer handling across the C source, the historical home of this project's heap overflows
- Taint mode and the checks it is supposed to enforce, plus setuid-adjacent behaviour
- The build and installation tooling the core ships, ExtUtils::MakeMaker among it
- The core modules the distribution ships, including Storable, Data::Dumper, File::Spec, IPC::Open3, Socket and the POSIX bindings
- The interpreter core: the tokenizer, the optree builder, the runtime ops and the reference counting underneath them
- The regular-expression engine end to end, from pattern compilation through matching, including recursion, backtracking and the Unicode property machinery
- The security policy asks for any security issue in perl5 privately on the security list and states plainly that there is no money for it. It declares no component boundary, so the perl interpreter and the modules the core distribution ships are the target
- The XS boundary and the C API that extensions use, where an interpreter invariant can be violated from outside
- Unicode and encoding handling, covering Encode, UTF-8 validation and the conversions between internal string representations
Out of scope (6)
- CPAN modules outside the core distribution, which belong to their own authors
- Distribution packaging and distro-specific patches rather than upstream perl5
- Perl programs with injection bugs of their own, as distinct from a defect in the interpreter
- Reports sent anywhere other than the security list, which puts them outside the documented embargo process
- Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary
- Running untrusted Perl source deliberately. The language ships no sandbox and claims none
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Email the address on the policy page , a closed-membership list monitored by the Perl security team. It is the documented channel and the only private one
-
Name the perl version and say whether the build is a distribution package or an upstream build.
-
For a regex finding, give the pattern and the subject string exactly, and say whether the pattern is attacker-controlled in the application you are modelling
-
State whether taint mode or a setuid wrapper is part of the setup, since those change what counts as a boundary crossing
-
CPAN modules outside the core distribution belong to their own authors, so identify the distribution a module ships in before you file
-
Hold the detail until the announcement is out.
Not accepted
-
CPAN modules outside the core distribution, which belong to their own authors
-
Distribution packaging and distro-specific patches rather than upstream perl5
-
Perl programs with injection bugs of their own, as distinct from a defect in the interpreter
-
Running untrusted Perl source deliberately. The language ships no sandbox and claims none
-
Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-57432 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, | High 8.4 | 13 Jul 2026 |
| CVE-2026-13221 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above | Critical 9.1 | 13 Jul 2026 |
| CVE-2026-14380 | DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name. Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code exe | High 8.8 | 7 Jul 2026 |
| CVE-2026-14739 | DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders. DBI version 1.650 sets a hard limit of 99,999 placeholders. | Critical 9.8 | 7 Jul 2026 |
| CVE-2026-14740 | DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal bui | Critical 9.1 | 7 Jul 2026 |
| CVE-2026-9698 | DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow. | Critical 9.8 | 9 Jun 2026 |
| CVE-2026-10879 | DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera. | Critical 9.8 | 5 Jun 2026 |
| CVE-2026-8376 | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length minco | Critical 9.8 | 26 May 2026 |
| CVE-2026-4176 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was | Critical 9.8 | 29 Mar 2026 |
| CVE-2024-56406 | A heap buffer overflow vulnerability was discovered in Perl. Release branches 5.34, 5.36, 5.38 and 5.40 are affected, including development versions from 5.33.1 through 5.41.10. When there are non-ASCII bytes in the left-hand-side of the `tr` operator, `S_do_trans_invmap` can overflow the destination pointer `d`. $ perl -e '$_ = "\x{FF}" x 1000000; tr/\xFF/\x{100}/;' Segmentation fault (core dumpe | High 8.4 | 13 Apr 2025 |
| CVE-2023-47039 | A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and execute `cmd.exe` within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working | High 7.8 | 2 Jan 2024 |
| CVE-2023-47038 | A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer. | High 7.0 | 18 Dec 2023 |
| CVE-2022-48522 | In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. | Critical 9.8 | 22 Aug 2023 |
| CVE-2023-31484 | CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. | High 8.1 | 29 Apr 2023 |
| CVE-2023-31486 | HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. | High 8.1 | 29 Apr 2023 |
| CVE-2020-16156 | CPAN 2.28 allows Signature Verification Bypass. | High 7.8 | 13 Dec 2021 |
| CVE-2021-36770 | Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and th | High 7.8 | 11 Aug 2021 |
| CVE-2019-20919 | An issue was discovered in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference. | Medium 4.7 | 17 Sep 2020 |
| CVE-2014-10402 | An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401. | Medium 6.1 | 16 Sep 2020 |
| CVE-2020-14393 | A buffer overflow was found in perl-DBI < 1.643 in DBI.xs. A local attacker who is able to supply a string longer than 300 characters could cause an out-of-bounds write, affecting the availability of the service or integrity of data. | High 7.1 | 16 Sep 2020 |
| CVE-2020-14392 | An untrusted pointer dereference flaw was found in Perl-DBI < 1.643. A local attacker who is able to manipulate calls to dbd_db_login6_sv() could cause memory corruption, affecting the service's availability. | Medium 5.5 | 16 Sep 2020 |
| CVE-2013-7490 | An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption. | Medium 5.3 | 11 Sep 2020 |
| CVE-2013-7491 | An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function requires a non-trivial amount of memory and the Perl stack gets reallocated. | Medium 5.3 | 11 Sep 2020 |
| CVE-2014-10401 | An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute. | Medium 6.1 | 11 Sep 2020 |
| CVE-2020-12723 | regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls. | High 7.5 | 5 Jun 2020 |
| CVE-2020-10878 | Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection. | High 8.6 | 5 Jun 2020 |
| CVE-2020-10543 | Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow. | High 8.2 | 5 Jun 2020 |
| CVE-2018-18313 | Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory. | Critical 9.1 | 7 Dec 2018 |
| CVE-2018-18314 | Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. | Critical 9.8 | 7 Dec 2018 |
| CVE-2018-18311 | Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. | Critical 9.8 | 7 Dec 2018 |
| CVE-2018-18312 | Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations. | Critical 9.8 | 5 Dec 2018 |
| CVE-2018-12015 | In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mechanism, and overwrite arbitrary files, via an archive file containing a symlink and a regular file with the same name. | High 7.5 | 7 Jun 2018 |
| CVE-2018-6797 | An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written. | Critical 9.8 | 17 Apr 2018 |
| CVE-2018-6798 | An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure. | High 7.5 | 17 Apr 2018 |
| CVE-2018-6913 | Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count. | Critical 9.8 | 17 Apr 2018 |
| CVE-2017-12814 | Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable. | Critical 9.8 | 28 Sep 2017 |
| CVE-2017-12837 | Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\N{}' escape and the case-insensitive modifier. | High 7.5 | 19 Sep 2017 |
| CVE-2017-12883 | Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape. | Critical 9.1 | 19 Sep 2017 |
| CVE-2015-8608 | The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument. | Critical 9.8 | 7 Feb 2017 |
| CVE-2016-1246 | Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via vectors related to an error message. | High 7.5 | 5 Oct 2016 |
| CVE-2016-6185 | The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory. | High 7.8 | 2 Aug 2016 |
| CVE-2016-1238 | (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-P | High 7.8 | 2 Aug 2016 |
| CVE-2015-8853 | The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80." | High 7.5 | 25 May 2016 |
| CVE-2016-2381 | Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. | High 7.5 | 8 Apr 2016 |
| CVE-2015-8607 | The canonpath function in the File::Spec module in PathTools before 3.62, as used in Perl, does not properly preserve the taint attribute of data, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string. | High 7.3 | 13 Jan 2016 |
| CVE-2013-7422 | Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression. | High 7.5 | 16 Aug 2015 |
| CVE-2013-7329 | The CGI::Application module before 4.50_50 and 4.50_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and environment details) via vectors related to the dump_html function. | Medium 5.0 | 6 Oct 2014 |
| CVE-2014-4330 | The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function. | Low 2.1 | 30 Sep 2014 |
| CVE-2010-4777 | The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash. | Medium 4.3 | 10 Feb 2014 |
| CVE-2013-1667 | The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key. | High 7.5 | 14 Mar 2013 |
| CVE-2012-6329 | The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application | High 7.5 | 4 Jan 2013 |
| CVE-2011-2728 | The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference. | Medium 4.3 | 21 Dec 2012 |
| CVE-2012-5195 | Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator. | High 7.5 | 18 Dec 2012 |
| CVE-2011-4363 | ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS. | Low 2.6 | 7 Oct 2012 |
| CVE-2012-1151 | Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function. | Medium 5.0 | 9 Sep 2012 |
| CVE-2011-2939 | Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Unicode string, which triggers a heap-based buffer overflow. | Medium 5.1 | 13 Jan 2012 |
| CVE-2011-3599 | The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack. | Medium 5.8 | 10 Oct 2011 |
| CVE-2011-2201 | The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass the taint protection mechanism via form input. | Medium 4.3 | 14 Sep 2011 |
| CVE-2011-0761 | Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir function call. | Medium 5.0 | 13 May 2011 |
| CVE-2011-1487 | The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string. | Medium 5.0 | 11 Apr 2011 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 4 Last 12 months 56 Lifetime Memory safety 45 % Regex engine 25 % Parsing/validation 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Perl ships as a base OS component on essentially every Linux and BSD distribution and on macOS. Debian's configuration tooling depends on it, debhelper depends on it, and a vast amount of build and sysadmin plumbing depends on it, so it runs on machines nobody thinks of as Perl machines. It is a large C codebase with a long record of heap overflows and regex-engine defects, and the regex engine in particular compiles patterns that real applications let users supply. The security policy carries a section headed 'Bounties for Perl vulnerabilities' whose content is that a non-profit volunteer effort pays nothing. sorona.xyz pays you directly on qualified, reproduced findings. In scope The security policy asks for any security issue in perl5 privately on the security list and states plainly that there is no money for it. It declares no component boundary, so the perl interpreter and the modules the core distribution ships are the target The interpreter core: the tokenizer, the optree builder, the runtime ops and the reference counting underneath them The regular-expression engine end to end, from pattern compilation through matching, including recursion, backtracking and the Unicode property machinery String and buffer handling across the C source, the historical home of this project's heap overflows Unicode and encoding handling, covering Encode , UTF-8 validation and the conversions between internal string representations sprintf , pack and unpack and the format-string machinery, which parse a specification and then write memory according to it Taint mode and the checks it is supposed to enforce, plus setuid-adjacent behaviour The core modules the distribution ships, including Storable , Data::Dumper , File::Spec , IPC::Open3 , Socket and the POSIX bindings The XS boundary and the C API that extensions use, where an interpreter invariant can be violated from outside Storable deserialisation and every other core path that reconstructs a Perl data structure from bytes The build and installation tooling the core ships, ExtUtils::MakeMaker among it Out of scope CPAN modules outside the core distribution, which belong to their own authors Distribution packaging and distro-specific patches rather than upstream perl5 Perl programs with injection bugs of their own, as distinct from a defect in the interpreter Running untrusted Perl source deliberately. The language ships no sandbox and claims none Reports sent anywhere other than the security list, which puts them outside the documented embargo process Resource exhaustion from an input the caller already controls, absent memory corruption or a crossed boundary Most-valued findings Memory corruption in the regex engine, reachable from a pattern or from a subject string. This is the densest part of Perl's CVE history and the part with the most attacker-controlled input in real applications Heap overflows anywhere in the C core, particularly in string, buffer and format handling. On this codebase that is code execution inside whatever daemon or build script embedded the interpreter sprintf , pack and unpack format handling, where a specification string decides how much memory gets written and where Unicode and encoding conversion defects, where a length computed in one representation is applied to a buffer in another Taint-mode bypasses, since taint is the one security boundary the interpreter actually promises to enforce Storable and other core deserialisation reaching code execution, given how much sysadmin tooling passes serialised structures between processes Anything reachable from a perl one-liner inside a build script or a packaging hook, because that is where perl runs on hosts nobody audits Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Email [email protected] , a closed-membership list monitored by the Perl security team. It is the documented channel and the only private one The team commits to an initial response within 72 hours and runs a documented embargo process from there The only thing offered is public credit in the release announcement. The policy has a dedicated section stating that a non-profit volunteer effort provides no monetary rewards Name the perl version and say whether the build is a distribution package or an upstream build. Distributions carry large patch sets and the difference decides who owns the bug For a regex finding, give the pattern and the subject string exactly, and say whether the pattern is attacker-controlled in the application you are modelling State whether taint mode or a setuid wrapper is part of the setup, since those change what counts as a boundary crossing CPAN modules outside the core distribution belong to their own authors, so identify the distribution a module ships in before you file Disclosure Coordinated on the closed [email protected] list, with an initial response targeted inside 72 hours and a documented embargo that runs to a coordinated release. Distributions rebuild perl in lockstep once the fix lands, so the release date is set by that coordination rather than by a day count you choose. Credit goes in the release announcement. Hold the detail until the announcement is out. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability