The flaw is an integer overflow in Perl’s regular‑expression engine. When an alternation contains more than 65,535 fixed‑string branches, the engine builds a trie that stores the delta between the first branch and the shared tail in a 16‑bit field. The field overflows and silently truncates the match decision table. The result is both false positives and false negatives, which can cause applications to grant unintended access or reject legitimate input when a regex is used for authentication, authorization, or filtering. This weakness matches CWE‑190, Integer Overflow or Wraparound.

All Perl releases up to and including 5.43.9 are vulnerable. The problem is resolved in the Perl 5.43.10 development release and all later versions.

The CVSS score of 9.1 categorizes this as a critical vulnerability. The EPSS score of <1% indicates a low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply a malicious pattern with an alternation that exceeds 65,535 branches, which is unlikely in most production environments but possible in specially crafted code paths.