CVE-2017-20230
perl: Storable versions before 3.05 for Perl has a stack overflow
CVE-2017-20230 is fixed in perl on 1 platform, first by DEBIAN-CVE-2017-20230, released May 15, 2026. It is not reported as exploited. Patch Radar priority: Urgent.
Urgent
CVSS
10.0
critical
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0064
50th percentile
Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| perl · Debian 12.15 (bookworm) | 5.28.0-3 | DEBIAN-CVE-2017-20230 | May 15, 2026 |
| perl · Debian 13.5 (trixie) | 5.28.0-3 | DEBIAN-CVE-2017-20230 | May 15, 2026 |
| perl · Debian 14 | 5.28.0-3 | DEBIAN-CVE-2017-20230 | May 15, 2026 |