String::Util versions before 1.36 use a regular‑expression pattern that matches trailing whitespace greedily, causing the Perl regex engine to backtrack quadratically when processing long runs of whitespace. When an attacker supplies such input to the trim or rtrim functions, the engine can exhaust CPU resources, resulting in a denial of service. This vulnerability is classified as CWE‑1333 and can affect any application that uses the module and passes untrusted data to trim or rtrim.

Vendor BAKERSCOT produces the module String::Util. Any Perl environment that imports String::Util with a version lower than 1.36 is affected. Versions 1.36 and later contain the fix and are safe. No other vendors or products are listed by the CNA for this issue.

The CVSS score of 7.5 indicates a high threat level for denial of service. The EPSS score of < 1% suggests a very low probability of exploitation in the wild, and the vulnerability is not present in the CISA KEV catalog. Attackers likely need to provide a long string of whitespace to the vulnerable functions; such input could originate from web forms, API payloads, or any interface that accepts arbitrary user data before trimming. Because the denial of service manifests as CPU exhaustion, an attacker can disrupt application availability once the vulnerable code processes the crafted input.