CVE-2026-77781: Perl Tie::Hash::Regex Exception Vulnerability

CVE-2026-77781 Overview

CVE-2026-77781 is a denial-of-service vulnerability in the Perl module Tie::Hash::Regex prior to version 2.0.0. The module implements a tied hash that falls back to regular expression matching when a lookup key is not already stored. The FETCH, EXISTS, and DELETE methods compile caller-supplied keys with a bare qr// and no eval guard. When an application looks up an externally supplied string that is not a valid regular expression, such as a single unmatched bracket, the interpreter throws an uncaught exception and terminates the calling code path. This maps to [CWE-248] Uncaught Exception.

Critical Impact
Applications passing untrusted input to a Tie::Hash::Regex lookup will die on any malformed regex pattern, enabling remote denial of service without authentication.

Affected Products

Perl module Tie::Hash::Regex versions before 2.0.0
Applications and services embedding Tie::Hash::Regex for hash lookups on untrusted input
Downstream CPAN distributions that depend on Tie::Hash::Regex < 2.0.0

Discovery Timeline

2026-08-22 - CVE-2026-77781 published to NVD
2026-08-22 - Public disclosure via OpenWall OSS Security Post
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-77781

Vulnerability Analysis

Tie::Hash::Regex overloads standard hash operations so that key lookups fall back to regex matching against stored keys. The FETCH, EXISTS, and DELETE methods first check for a literal key match. On miss, they compile the caller-provided key as a regular expression using a bare qr// operator. Perl's regex compiler raises a fatal exception when it encounters an invalid pattern. Because the module wraps the compilation in no eval block, the exception propagates to the caller and terminates execution of the surrounding request handler.

Any web service, mail filter, or long-running Perl daemon that uses this module to look up externally supplied strings can be crashed with a single crafted input. Repeated invocations amplify the impact into sustained service unavailability.

Root Cause

The root cause is missing exception handling around dynamic regex compilation. The module treats every unknown key as a valid pattern and provides no eval { } guard, no input validation, and no sanitization of regex metacharacters before invoking qr//.

Attack Vector

Exploitation requires only that an attacker control a string passed to a hash lookup on a tied Tie::Hash::Regex instance. Sending a payload such as [, (, or * as a lookup key triggers a fatal Unmatched [ or similar regex compilation error. The attack is network-reachable, requires no authentication, and needs no user interaction.

text

# Security patch metadata from Changes file
+2026-08-21  Dave Cross <dave@perlhacks.com>
+
+  * Version 2.0.0
+
+  * Fix CVE-2026-77781
+
 2021-01-25  Dave Cross <dave@perlhacks.com>
 
   * Version 1.14

Source: GitHub Commit Patch

text

# Version bump in lib/Tie/Hash/Regex.pm
 @EXPORT = qw();
 @EXPORT_OK =();
 
-$VERSION = 1.14;
+$VERSION = '2.0.0';

Source: GitHub Commit Patch

Detection Methods for CVE-2026-77781

Indicators of Compromise

Perl process crashes or worker restarts correlated with request payloads containing unbalanced regex metacharacters such as [, (, \, or *.
Error log entries containing strings like Unmatched [ in regex, Unmatched (, or Trailing \ in regex originating from Tie/Hash/Regex.pm.
Elevated 5xx response rates from Perl-backed HTTP services when specific query or form fields are supplied.

Detection Strategies

Inventory Perl dependencies with cpanm --showdeps or carton list and flag any Tie::Hash::Regex release earlier than 2.0.0.
Enable stack trace capture in Perl workers so that uncaught qr// compilation exceptions surface with module attribution.
Add web application firewall rules that identify malformed regex payloads in parameters that reach known Perl endpoints.

Monitoring Recommendations

Track worker crash and restart metrics per endpoint and alert on sudden spikes tied to specific client IPs.
Aggregate Perl die messages centrally and search for Tie::Hash::Regex stack frames.
Monitor upstream advisory feeds and CPAN release notifications for the affected distribution.

How to Mitigate CVE-2026-77781

Immediate Actions Required

Upgrade Tie::Hash::Regex to version 2.0.0 or later on every host running Perl services that consume the module.
Audit application code for hash lookups against Tie::Hash::Regex instances that accept untrusted input.
Restart Perl workers and long-running daemons after upgrading to ensure the patched module is loaded into memory.

Patch Information

The maintainer released Tie::Hash::Regex 2.0.0 addressing this issue. Review the fix details in the MetaCPAN Release Changes and the corresponding GitHub Commit Patch. Install via cpanm Tie::Hash::Regex@2.0.0 or update the project's cpanfile and rebuild the dependency set.

Workarounds

Wrap lookups in an eval { } block and treat exceptions as a lookup miss until the upgrade is deployed.
Validate or sanitize keys before passing them to a tied hash by rejecting inputs containing unbalanced regex metacharacters.
Restrict the fields that reach Tie::Hash::Regex lookups to server-controlled values while patching is scheduled.

bash

# Upgrade to the patched release
cpanm Tie::Hash::Regex@2.0.0

# Verify the installed version
perl -MTie::Hash::Regex -e 'print $Tie::Hash::Regex::VERSION, "\n"'