CVE-2026-8796: Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input

[Paul Johnson <paul () pjcj net>]

========================================================================
CVE-2026-8796                                        CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-8796
  Distribution:  Sereal-Decoder
      Versions:  before 5.005

      MetaCPAN:  https://metacpan.org/dist/Sereal-Decoder
      VCS Repo:  https://github.com/Sereal/Sereal


Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds
read via crafted input

Description
-----------
Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds
read via crafted input.

In Perl/Decoder/srl_decoder.c, srl_read_object() and srl_read_hash()
process a COPY tag, a back-reference whose target byte the decoder
re-decodes as a fresh tag. When that target byte matches the
SHORT_BINARY pattern (an inline string whose length is encoded in the
low bits of the tag), the resulting read is not bounded to precede the
COPY tag's own offset and can run past the end of the input buffer. An
attacker controlled COPY offset can land inside a previously decoded
value rather than on a tag boundary, planting a byte that the decoder
reads as a SHORT_BINARY tag and consuming up to 31 following bytes from
the heap as a class name (OBJECT path) or hash key (HASH path).

Problem types
-------------
- CWE-125 Out-of-bounds Read

Solutions
---------
Upgrade to Sereal::Decoder 5.005 or later.


References
----------
https://github.com/Sereal/Sereal/commit/303a2c69cdba80bf37a3ff43461e0aa78198a7a3.patch
https://metacpan.org/release/YVES/Sereal-Decoder-5.005/changes

Timeline
--------
- 2026-05-13: Issue reported.
- 2026-05-19: Fix released in Sereal::Decoder 5.005.
- 2026-05-20: Fix verified against proofs of concept.

-- 
Paul Johnson - paul () pjcj net