CVE-2026-8796: Sereal::Decoder Buffer Overflow Flaw

CVE-2026-8796 Overview

CVE-2026-8796 is a heap out-of-bounds read vulnerability in Sereal::Decoder for Perl, affecting versions before 5.005. The flaw resides in Perl/Decoder/srl_decoder.c, where srl_read_object() and srl_read_hash() mishandle the COPY tag during deserialization. An attacker-controlled COPY offset can cause the decoder to interpret an arbitrary byte as a SHORT_BINARY tag and read up to 31 bytes past intended buffer bounds. Crafted serialized input delivered to any application using Sereal::Decoder can trigger the condition. The vulnerability is categorized under [CWE-125] Out-of-bounds Read.

Critical Impact

Successful exploitation leaks adjacent heap memory through OBJECT class names or HASH keys, enabling information disclosure and potential process crashes in Perl applications consuming untrusted Sereal data.

Affected Products

• Sereal::Decoder Perl module versions before 5.005
• Perl applications that deserialize untrusted Sereal-formatted input
• Downstream distributions bundling vulnerable Sereal::Decoder releases

Discovery Timeline

• 2026-05-31 - CVE-2026-8796 published to NVD
• 2026-06-01 - Public disclosure via OpenWall oss-security mailing list
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-8796

Vulnerability Analysis

The Sereal binary protocol uses a COPY tag as a back-reference whose target byte the decoder re-decodes as a fresh tag. When the referenced byte matches the SHORT_BINARY tag pattern, the length is encoded in the low bits of the tag itself. The decoder then consumes up to 31 following bytes as an inline string. In vulnerable releases, this secondary read is not bounded to precede the COPY tag's own offset and is not validated against the input buffer end.

An attacker who controls the COPY offset can point inside a previously decoded value rather than at a legitimate tag boundary. The byte at that position is then interpreted as a SHORT_BINARY tag. The decoder reads adjacent heap bytes as a class name on the OBJECT path or as a hash key on the HASH path, returning them to the caller.

Root Cause

The root cause is missing bounds enforcement in srl_read_object() and srl_read_hash() when reprocessing a COPY target. The functions trust the redirected tag without verifying that the resulting read remains within the declared input buffer and within the offset range valid for COPY semantics. This violates the safety invariants of the Sereal format.

Attack Vector

Exploitation requires the target application to decode attacker-supplied Sereal data, which is common in caching layers, RPC frameworks, and message queues that exchange serialized Perl objects. The attacker crafts a payload containing a COPY tag whose offset points into a prior value byte that matches the SHORT_BINARY mask. When the decoder processes an OBJECT or HASH structure referencing that COPY, it reads past the intended boundary into adjacent heap memory. Recovered bytes are returned as class names or hash keys, exposing sensitive process memory or causing decoder aborts.

No synthetic exploitation code is published here. Refer to the GitHub Commit Patch and the OpenWall OSS Security Post for protocol-level detail.

Detection Methods for CVE-2026-8796

Indicators of Compromise

• Perl processes using Sereal::Decoder versions below 5.005 crashing with SIGSEGV or AddressSanitizer heap-buffer-overflow reports during decode operations
• Unexpected non-printable byte sequences appearing in logged hash keys or blessed class names downstream of Sereal deserialization
• Inbound payloads containing COPY tags with offsets that resolve into the middle of prior SHORT_BINARY or numeric value bodies

Detection Strategies

• Inventory all Perl applications and CPAN dependencies to enumerate installed Sereal::Decoder versions and flag any below 5.005
• Validate inbound Sereal payloads against a strict parser that rejects COPY offsets not landing on a recorded tag boundary
• Instrument decode paths with AddressSanitizer or Valgrind in pre-production to surface heap out-of-bounds reads during fuzzing

Monitoring Recommendations

• Alert on repeated decoder exceptions or process restarts in services that ingest serialized objects from untrusted sources
• Capture and retain raw Sereal payloads at network or message-broker boundaries for retrospective analysis
• Monitor CPAN module update events on production hosts to confirm the patched Sereal::Decoder version is deployed

How to Mitigate CVE-2026-8796

Immediate Actions Required

• Upgrade Sereal::Decoder to version 5.005 or later on all systems decoding Sereal data
• Restrict Sereal decoding to trusted producers until the patched version is installed across the fleet
• Audit application code for entry points that pass externally sourced bytes into Sereal::Decoder::decode_sereal

Patch Information

The upstream fix is delivered in Sereal-Decoder-5.005, published on MetaCPAN. The corrective change is committed as 303a2c69cdba80bf37a3ff43461e0aa78198a7a3 in the Sereal repository, which adds bounds enforcement when a COPY target is reinterpreted as a tag. Review the MetaCPAN Release Changes and the GitHub Commit Patch before rollout.

Workarounds

• Terminate Sereal traffic from untrusted networks at an application gateway and reject payloads that exceed expected size or contain unexpected tag sequences
• Run Perl workers that decode Sereal under seccomp or process isolation to contain information leaks from out-of-bounds reads
• Where feasible, switch interchange between untrusted parties to a format with strict schema validation until the patched module is deployed

# Configuration example: upgrade Sereal::Decoder via cpanm
cpanm --reinstall Sereal::Decoder@5.005
perl -MSereal::Decoder -e 'print $Sereal::Decoder::VERSION, "\n"'