Tie::Hash::Regex versions prior to 2.0.0 will raise an exception when a lookup key cannot be parsed as a valid regular expression. This flaw is a CWE‑248 exception handling weakness. When an application performs FETCH, EXISTS, or DELETE on a tied hash with an externally supplied key that is not a valid regex pattern, the module compiles the key with a bare qr// without any exception guard, causing the Perl interpreter to die. The resulting crash truncates the application’s execution and can result in a denial of service.

This issue affects any installation that uses the Tie::Hash::Regex Perl module of version 1.x or earlier. The module is distributed by the DAVECROSS project and is used in Perl environments where arbitrary strings are queried against a tied hash.

The vulnerability is exploitable if an attacker can provide or influence the key used in a hash lookup. The CVSS score of 7.5 indicates a high severity; the EPSS score of < 1% shows a low but nonzero probability of exploitation in the wild. The module falls back to compiling the input key as an unguarded regex match when it is not already stored in the hash, causing the Perl interpreter to die when the key contains an invalid regex pattern such as an unmatched bracket. If an application receives externally supplied strings and uses them directly as hash keys, the resulting crash truncates the application’s execution and can lead to a denial of service. Though the exploitation vector requires influencing a lookup key, such as through user input, the impact is significant for systems that rely on Tie::Hash::Regex for dynamic hash lookups.