XS-Parse-Keyword flaw affects versions 0.40 to 0.49
An advisory published by oss-sec on September 28, 2026 describes CVE-2026-85644: XS::Parse::Infix treats a number as an array reference in versions 0.40 to 0.49 of the XS-Parse-Keyword distribution.
Source: CVE-2026-85644: XS::Parse::Infix para Perl trata um número como referência de array (seclists.org). Text prepared with AI from this source.
What happened and what to do
The oss-sec advisory, published on September 28, 2026, identifies CVE-2026-85644 in the Perl XS-Parse-Keyword distribution, affecting versions 0.40 to 0.49. The flaw described in XS::Parse::Infix causes a number to be treated as an array reference.
A company using Perl can inventory dependencies and versions, locate affected systems, and add automated checks to detect this range in builds and production environments. A response can also include regression tests and dependency monitoring to track a correction before planning an upgrade.
How the consultancy can help
Wendelmaques can diagnose exposure across Perl systems and dependencies, scope an inventory, automated checks and tests, and implement and operate these controls to meet the company’s needs.
Next step
Send a short description of your Perl environment and dependencies to receive a scoped proposal for diagnosis and implementation.
Let's assess your project
I reply with scope and a proposal.