CVE-2026-14895: String::Util ReDoS Vulnerability in Perl trim and rtrim Functions

Technical summary

The vulnerability exists in String::Util's trim and rtrim functions, which use the regex pattern s/\s*$//u to strip trailing whitespace. The \s* quantifier matches greedily, and when the $ anchor fails to match (because a non-whitespace character exists somewhere in the input after the whitespace run), the regex engine backtracks and retries at each character position within the whitespace sequence. For a string with N whitespace characters, this creates O(N²) matching attempts, causing quadratic backtracking. Version 1.36 fixes this by changing the pattern to s/\s+$//u, which requires at least one whitespace character and avoids the catastrophic backtracking scenario. The vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity).

Business impact

Applications relying on String::Util to sanitize or process user-supplied data face denial-of-service risk. An attacker can craft input that exhausts CPU resources on backend systems, degrading availability for legitimate users. For SaaS platforms, APIs, and batch-processing jobs that accept untrusted text input, this could enable cost-based attacks (forcing extended compute time) or service disruptions. The severity is particularly high in multi-tenant environments where one malicious request can degrade performance for other customers.

Affected systems

Any Perl application or system using String::Util versions prior to 1.36 is affected, particularly those that pass user-controlled data to the trim or rtrim functions. This includes web applications using Perl frameworks, data processing pipelines, logging systems, and command-line utilities that employ this library. Because String::Util is a common utility library in the Perl ecosystem, the attack surface could be broad across organizations with legacy Perl codebases.

Exploitability

Exploitability is straightforward: no authentication or special privileges are required. An attacker need only supply a crafted string—such as a URL parameter, form field, API payload, or file content—containing megabytes of consecutive whitespace to trigger the denial of service. Attack vectors include web-based input fields, API endpoints, file uploads, and any other mechanism where untrusted data reaches the vulnerable functions. The CVSS score of 7.5 reflects the network-accessible nature and ease of exploitation, though impact is limited to availability.

Remediation

Upgrade String::Util to version 1.36 or later. Organizations should inventory Perl dependencies in their applications and conduct a targeted patch deployment. For environments where immediate patching is not feasible, input validation or length limits on strings passed to trim and rtrim functions can provide temporary mitigation, though upgrading remains the definitive fix.

Patch guidance

Update String::Util via your Perl package manager (CPAN, cpanminus, etc.) to version 1.36 or any subsequent release. Test thoroughly in a staging environment before production deployment, as the regex change is minimal and low-risk, but validate that whitespace-stripping behavior remains consistent with application expectations. Verify the update via your package manager's audit or dependency-check tools to confirm affected versions are no longer present.

Detection guidance

Monitor for sustained high CPU usage on processes known to use String::Util, particularly in correlation with unusual input patterns (e.g., requests with very long whitespace sequences). Application performance monitoring (APM) tools should flag regex-induced CPU spikes. During incident response, examine recent input logs for strings with prolonged whitespace runs directed at text-processing endpoints. Static code analysis tools can identify calls to String::Util's trim or rtrim functions to help prioritize patching efforts.

Why prioritize this

Despite not being on the KEV list, this vulnerability warrants prioritization because: (1) exploitability is trivial—no special conditions required, (2) affected organizations likely have Perl codebases that are harder to inventory than modern frameworks, (3) the attack is passive and leaves minimal forensic traces, making it attractive for opportunistic attackers, and (4) a one-line patch is available. Organizations should treat this as high-priority for Perl-dependent systems, medium for others.

Risk score, explained

The CVSS 7.5 (HIGH) score reflects a network-accessible denial-of-service vector with no authentication, privileges, or user interaction required. Impact is confined to availability; confidentiality and integrity are unaffected. The score appropriately captures the ease and breadth of attack surface, though actual risk depends on whether an organization's Perl applications expose trim or rtrim to untrusted input. Risk is elevated in web-facing or API-driven environments and lower in isolated or air-gapped systems.

Frequently asked questions