Tie::Hash::Regex versions prior to 2.0.0 will raise an exception when a lookup key cannot be parsed as a valid regular expression. This flaw is a CWE‑248 exception handling weakness. When an application performs FETCH, EXISTS, or DELETE on a tied hash with an externally supplied key that is not a valid regex pattern, the module compiles the key with a bare qr// without any exception guard, causing the Perl interpreter to die. The resulting crash truncates the application’s execution and can result in a denial of service.

This issue affects any installation that uses the Tie::Hash::Regex Perl module of version 1.x or earlier. The module is distributed by the DAVECROSS project and is used in Perl environments where arbitrary strings are queried against a tied hash.

The vulnerability is exploitable if an attacker can provide or influence the key used in a hash lookup. Based on the description, it is inferred that a remote attacker could inject malformed regex strings into user inputs that are subsequently used as hash keys, potentially triggering a denial of service. EPSS data is not available; KEV is not listed in the CISA KEV catalog; however, the lack of built‑in input validation and the severity of an application crash indicate a high risk for systems that rely on this module.