CVE-2026-14895: Perl String::Util DoS Vulnerability

CVE-2026-14895 Overview

CVE-2026-14895 is a regular expression denial of service (ReDoS) vulnerability in the String::Util Perl module versions before 1.36. The trim and rtrim functions use the pattern s/\s*$//u to strip trailing whitespace. The greedy \s* quantifier combined with the $ anchor triggers quadratic backtracking when a long whitespace run is followed by a non-whitespace character. Any caller that passes untrusted input to these functions can trigger CPU exhaustion. The issue is tracked under CWE-1333 (Inefficient Regular Expression Complexity).

Critical Impact
Remote attackers can exhaust CPU resources by submitting crafted strings containing long whitespace sequences to any application that trims untrusted input using String::Util.

Affected Products

String::Util Perl module versions prior to 1.36
Perl applications on CPAN that pass untrusted input to trim() or rtrim()
Downstream distributions bundling String::Util from CPAN author BAKERSCOT

Discovery Timeline

2026-07-07 - CVE-2026-14895 published to the National Vulnerability Database
2026-07-07 - Advisory posted to the OpenWall OSS-Security mailing list
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-14895

Vulnerability Analysis

The vulnerability resides in lib/String/Util.pm within the trim() and rtrim() subroutines. Both functions apply the substitution s/\s*$//u to remove trailing whitespace. The \s* quantifier matches zero or more whitespace characters greedily. When the anchor $ fails because a non-whitespace character follows the matched whitespace, the regex engine restarts the match at every offset of the whitespace run. This produces quadratic time complexity relative to input length.

An attacker supplying a string such as "A" . (" " x N) . "B" forces the engine to perform roughly N² backtracking steps. Inputs of a few hundred kilobytes are sufficient to stall a Perl worker process for seconds or minutes, blocking request handlers and consuming CPU cycles.

Root Cause

The root cause is the use of a greedy zero-or-more quantifier anchored to end-of-string without an atomic group or possessive quantifier. When the anchor assertion fails, Perl's backtracking regex engine explores every possible starting offset within the whitespace run. The u modifier only affects character semantics, not backtracking behavior.

Attack Vector

Exploitation requires no authentication and no user interaction. Any network-facing Perl application that passes attacker-controlled data to String::Util::trim or String::Util::rtrim is exposed. Typical entry points include HTTP form parameters, JSON fields, HTTP headers, email addresses, and CSV cells processed by web frameworks or data ingestion pipelines.

The fix replaces \s*$ with \s+$. The \s+ quantifier requires at least one whitespace character to match, which prevents the engine from retrying at every offset once the anchor fails.

text

 		return undef;
 	}
 
-	$s =~ s/^\s*//u;
-	$s =~ s/\s*$//u;
+	$s =~ s/^\s+//u;
+	$s =~ s/\s+$//u;
 
 	return $s;
 }

Source: GitHub commit f8150867 - Security patch in lib/String/Util.pm.

Detection Methods for CVE-2026-14895

Indicators of Compromise

Perl worker processes sustaining 100% CPU while handling a single request
HTTP requests containing unusually long runs of whitespace followed by a non-whitespace character
Request timeouts and thread pool exhaustion in web applications that call trim() or rtrim() on user input
Repeated slow requests targeting endpoints that normalize form fields, headers, or JSON payloads

Detection Strategies

Audit application code and CPAN dependency trees for use String::Util and calls to trim or rtrim with untrusted arguments
Inspect installed module version with perl -MString::Util -e 'print $String::Util::VERSION' and flag versions below 1.36
Enable Perl regex debugging (use re 'debug') in staging to profile pathological inputs against affected code paths

Monitoring Recommendations

Alert on Perl process CPU time exceeding a per-request baseline threshold
Log request bodies and header sizes at the reverse proxy, and flag payloads with contiguous whitespace runs beyond a reasonable limit
Correlate application latency spikes with request payload entropy and length to detect algorithmic complexity abuse

How to Mitigate CVE-2026-14895

Immediate Actions Required

Upgrade String::Util to version 1.36 or later on every host that ships the module
Enumerate applications that call trim or rtrim on network-supplied input and prioritize their patching
Enforce request size limits and per-request CPU timeouts at the web server or reverse proxy layer
Validate and reject input containing excessive whitespace before passing it to string utility routines

Patch Information

The fix is available in String::Util version 1.36, published by CPAN author BAKERSCOT. Review the MetaCPAN diff between 1.35 and 1.36 and the GitHub release notes before deploying.

Workarounds

Replace calls to String::Util::trim and rtrim with an inline substitution using \s+ anchors until the module is upgraded
Truncate input to a maximum length before applying trim operations to bound worst-case regex runtime
Wrap trim calls in a Perl alarm() timeout to abort runaway regex evaluations

bash

# Upgrade String::Util from CPAN
cpanm String::Util@1.36

# Verify installed version
perl -MString::Util -e 'print "String::Util $String::Util::VERSION\n"'

# Inline replacement pattern for code that cannot be upgraded immediately
# $s =~ s/^\s+//u;
# $s =~ s/\s+$//u;