CVE-2026-14895
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in the String::Util library for Perl before version 1.36 allows a Regular Expression Denial of Service (ReDoS) attack. The trim and rtrim functions use the regular expression s/\s*$//u, which causes quadratic backtracking on long whitespace strings, leading to CPU exhaustion.
Risk Assessment
The organization is at risk of a DoS attack if it processes untrusted input using the trim or rtrim functions. An attacker can send a string containing a long whitespace sequence, causing high CPU load and potentially disrupting application availability.
Recommendation
Immediately update the String::Util library to version 1.36 or later. If an update is not possible, restrict processing of untrusted data by trim and rtrim functions or implement a custom whitespace removal routine.
Related vulnerabilities
- CVE-2026-85440Critical
Pre-authentication heap overflow vulnerability in MOOS core-moos through 10.4.0 in MOOSCommPkt packet handling. Attackers can declare a negative packet length, leading to writing arbitrary data past a four-byte heap buffer during the HandShake phase.
- CVE-2026-85438Critical
Buffer overflow vulnerability in MOOS-IvP through 24.8.1 in StringToIvPFunction(), where dimension, piece, and degree counts from encoded BHV_IPF payloads are used without validation. Attackers can supply crafted payloads to write past the IvPBox weight array.
- CVE-2026-85437Critical
Multiple buffer overflow vulnerabilities in MOOS-IvP through 24.8.1 in IvP function string decoders that trust attacker-controlled length fields. Crafted encoded strings can overflow heap and stack buffers, potentially enabling remote code execution.
- CVE-2026-85435Critical
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages, allowing any publisher to enroll attacker-controlled shore routes. Attackers can receive bridged vehicle traffic including sensor data and control information.
- CVE-2026-85434Critical
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
- CVE-2026-85433Critical
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted messages to open new listeners and redirect or duplicate traffic.
- CVE-2026-85430Critical
MOOS essential-moos through 10.0.1 contains an authentication bypass in pShare that accepts UDP datagrams from any source and republishes them with attacker-claimed identity. Attackers can inject messages under spoofed identities or crash the pShare process.
- CVE-2026-85428Critical
MOOS core-moos through 10.4.0 contains an authentication bypass in the optional MOOSDB HTTP server, allowing unauthenticated clients to write variables. Attackers can modify MOOS variables including actuator and override commands without authentication.
- CVE-2026-85426Critical
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters to execute arbitrary commands as the uMemWatch process user.
- CVE-2026-85425Critical
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish messages with command substitution syntax to execute arbitrary commands as the iSay process user.
Original NVD description (English source)
String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s*$//u. Because \s* matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex engine retries the match at each offset of a long whitespace run, producing quadratic backtracking. The fix replaces \s*$ with \s+$. Any caller that passes untrusted input to trim or rtrim can trigger CPU exhaustion with a string containing a long run of whitespace.