CVE-2026-14895

{
  "id": "CVE-2026-14895",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-07-07T23:16:54.293",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service.\n\nThe trim and rtrim functions stripped trailing whitespace with s/\\s*$//u. Because \\s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \\s*$ with \\s+$.\n\nAny caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace."
    },
    {
      "lang": "es",
      "value": "Las versiones de String::Util anteriores a la 1.36 para Perl son susceptibles a una denegación de servicio por expresión regular.\n\nLas funciones trim y rtrim eliminaban los espacios en blanco finales con s/\\s$//u. Debido a que \\s coincide de forma codiciosa y el ancla $ falla cada vez que un carácter que no es espacio en blanco sigue al espacio en blanco, el motor de expresiones regulares reintenta la coincidencia en cada desplazamiento de una secuencia larga de espacios en blanco, produciendo un retroceso cuadrático. La solución reemplaza \\s$ con \\s+$.\n\nCualquier llamador que pase entrada no confiable a trim o rtrim puede desencadenar el agotamiento de la CPU con una cadena que contenga una secuencia larga de espacios en blanco."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "BAKERSCOT",
          "product": "String::Util",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "String-Util",
          "programFiles": [
            "lib/String/Util.pm"
          ],
          "programRoutines": [
            {
              "name": "String::Util::trim"
            },
            {
              "name": "String::Util::rtrim"
            }
          ],
          "repo": "https://github.com/scottchiefbaker/String-Util",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.36",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T14:05:12.698100Z",
          "id": "CVE-2026-14895",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/scottchiefbaker/String-Util/commit/f8150867aaeb8f57c59601aefb2193f2caed8745.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://github.com/scottchiefbaker/String-Util/releases",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/BAKERSCOT/String-Util-1.36/diff/BAKERSCOT/String-Util-1.35#lib/String/Util.pm",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/07/07/18",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}