CVE-2026-8796: Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input

Synopsis

A heap out-of-bounds read vulnerability affects Sereal::Decoder for Perl in versions before 5.005. The flaw is reachable over the network without authentication, but requires a user or service to process attacker-supplied Sereal-encoded input. Successful exploitation lets an attacker read up to 31 bytes of heap memory beyond the input buffer, exposing sensitive in-process data, and can also crash the decoder process. A patched-image rebuild at version 5.005 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The decoder must be exposed to attacker-supplied input arriving over the network, meaning the service processing Sereal data must be reachable remotely.

• AuthenticationNot required

  No credentials or account are required; the attacker only needs to deliver crafted Sereal-encoded bytes to the target service.

• Victim interactionRequired

  A user or service process must actively decode the attacker-crafted Sereal payload, making this a social-engineering or supply-chain vector where the victim processes malicious input.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout beyond constructing a valid COPY offset.

Blast Radius

• Reads up to 31 contiguous bytes of heap memory past the end of the input buffer, which may include in-memory strings such as session tokens, decryption keys, or other recently allocated Perl scalars.
• Exposes decoded hash keys or object class names from earlier allocations on the heap, potentially leaking application-internal data structures to the attacker.
• Crashes the Sereal::Decoder process when the out-of-bounds read crosses an unmapped memory page, causing denial of service for any service that depends on Sereal deserialization.