CVE-2026-13221

Critical

Advisory

Published 13 Jul 2026In the index since 5 Sept 2026

Severity: Critical; worst across findings
CVSS: 9.1; base score, highest
EPSS: 0.004; 37th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,382; of 17,792 indexed, latest versions
Container images: 2,349; deployed by those charts
Fix available: 41 of 41; affected packages

Red Hat Security Advisory: perl security update

Carried by container images the latest versions of 2,382 of 17,792 indexed charts deploy, on 2,349 images.

Affected package	Affected versions	Fixed in	Images
perldeb	5.18.2-2ubuntu1, 5.18.2-2ubuntu1.1, 5.18.2-2ubuntu1.4, 5.18.2-2ubuntu1.7+39 more	5.18.2-2ubuntu1.7+esm8, 5.22.1-9ubuntu0.9+esm3, 5.26.1-6ubuntu0.7+esm3, 5.30.0-9ubuntu0.5+esm3+5 more	2,311
perlrpm	0:1.01-481.1.el9_6, 0:1.28-416.el8, 0:1.28-417.el8_3, 0:1.28-419.el8_4.1+12 more	0:1.01-484.el9_8, 0:1.28-423.el8_10.1, 0:5.74-475.module+el8.10.0+24767+f69b15b5, 0:5.74-484.el9_8+2 more	38
perl-Carprpm	1.42-396.el8	0:1.50-439.module+el8.10.0+21354+3ad137bb	16
perl-constantrpm	1.33-396.el8	0:1.33-1001.module+el8.10.0+21354+3ad137bb	16
perl-Exporterrpm	5.72-396.el8	0:5.74-458.module+el8.10.0+21354+3ad137bb	16
perl-File-Pathrpm	2.15-2.el8	0:2.16-439.module+el8.10.0+21354+3ad137bb	16
perl-parentrpm	1:0.237-1.el8	1:0.238-457.module+el8.10.0+21354+3ad137bb	16
perl-PathToolsrpm	3.74-1.el8	0:3.78-439.module+el8.10.0+21354+3ad137bb	16
perl-Scalar-List-Utilsrpm	3:1.49-2.el8	4:1.55-457.module+el8.10.0+21354+3ad137bb	16
perl-Socketrpm	4:2.027-3.el8	4:2.031-1.module+el8.10.0+21354+3ad137bb	16
perl-Text-Tabs+Wraprpm	2013.0523-395.el8	0:2013.0523-396.module+el8.10.0+21354+3ad137bb	16
perl-threadsrpm	1:2.21-2.el8	1:2.25-457.module+el8.10.0+21354+3ad137bb	16
perl-threads-sharedrpm	1.58-2.el8	0:1.61-457.module+el8.10.0+21354+3ad137bb	16
perl-Unicode-Normalizerpm	1.25-396.el8	0:1.27-458.module+el8.10.0+21354+3ad137bb	16
perl-Encoderpm	4:2.97-3.el8	4:3.08-461.module+el8.10.0+21354+3ad137bb	15
perl-File-Temprpm	0.230.600-1.el8	1:0.231.100-1.module+el8.10.0+21354+3ad137bb	15
perl-Getopt-Longrpm	1:2.50-4.el8	1:2.52-1.module+el8.10.0+21354+3ad137bb	15
perl-HTTP-Tinyrpm	0.074-1.el8, 0.074-1.el8_6.1, 0.074-2.el8, 0.074-2.el8_9.1+1 more	0:0.078-1.module+el8.10.0+21354+3ad137bb	15
perl-MIME-Base64rpm	3.15-396.el8	0:3.15-1001.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Escapesrpm	1:1.07-395.el8	1:1.07-396.module+el8.10.0+21354+3ad137bb	15
perl-podlatorsrpm	4.11-1.el8	1:4.14-457.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Perldocrpm	3.28-396.el8	0:3.28.01-443.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Simplerpm	1:3.35-395.el8	1:3.42-1.module+el8.10.0+21354+3ad137bb	15
perl-Pod-Usagerpm	4:1.69-395.el8	4:2.01-1.module+el8.10.0+21354+3ad137bb	15
perl-Storablerpm	1:3.11-3.el8	1:3.21-457.module+el8.10.0+21354+3ad137bb	15
perl-Term-ANSIColorrpm	4.06-396.el8	0:5.01-458.module+el8.10.0+21354+3ad137bb	15
perl-Term-Caprpm	1.17-395.el8	0:1.17-396.module+el8.10.0+21354+3ad137bb	15
perl-Text-ParseWordsrpm	3.30-395.el8	0:3.30-396.module+el8.10.0+21354+3ad137bb	15
perl-Time-Localrpm	1:1.280-1.el8	2:1.300-4.module+el8.10.0+21354+3ad137bb	15
perl-Data-Dumperrpm	2.167-399.el8	0:2.174-440.module+el8.10.0+21354+3ad137bb	14
perl-Digestrpm	1.17-395.el8	0:1.20-1.module+el8.10.0+21354+3ad137bb	13
perl-Digest-MD5rpm	2.55-396.el8	0:2.58-1.module+el8.10.0+21354+3ad137bb	13
perl-IO-Socket-IPrpm	0.39-5.el8	0:0.41-2.module+el8.10.0+21354+3ad137bb	13
perl-libnetrpm	3.11-3.el8	0:3.13-1.module+el8.10.0+21354+3ad137bb	13
perl-URIrpm	1.73-3.el8	0:1.76-5.module+el8.10.0+21354+3ad137bb	13
perl-Thread-Queuerpm	3.13-1.el8	0:3.14-457.module+el8.10.0+21354+3ad137bb	2
perl-Compress-Raw-Bzip2rpm	2.081-1.el8	0:2.096-1.module+el8.10.0+21354+3ad137bb	1
perl-Compress-Raw-Zlibrpm	2.081-1.el8	0:2.096-2.module+el8.10.0+21354+3ad137bb	1
perl-Digest-SHArpm	1:6.02-1.el8	1:6.02-2.module+el8.10.0+21354+3ad137bb	1
perl-Encode-Localerpm	1.05-10.module+el8.3.0+6498+9eecfe51	0:1.05-10.module+el8.10.0+21354+3ad137bb	1
perl-IO-Compressrpm	2.081-1.el8	0:2.096-2.module+el8.10.0+24402+ce90c7a0	1

OSV records: DEBIAN-CVE-2026-13221 UBUNTU-CVE-2026-13221 RHSA-2026:67155 RHSA-2026:67156 RHSA-2026:67162 RHSA-2026:67278 RLSA-2026:67155 ECHO-6100-7255-ee29
Also known as: USN-8675-1, USN-8675-2, USN-8684-1

Charts affected

2,382 by stars

Chart	Latest	Affected images	Radar Score

Container images carrying it

2,349 by charts deploying them

A fixed version is listed for 41 of the 41 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/donkie/spoolman :0.26.1	cf9b41e17b93	perl@5.36.0-7+deb12u3	no fix listed	3
ghcr.io/huggingface/text-embeddings-inference :cpu-1.5	0502794a4d86	perl@5.36.0-7+deb12u1	no fix listed	3
ghcr.io/smarter-project/hydra/crismux :main	673d5229df1f	perl@5.36.0-7+deb12u3	no fix listed	3
quay.io/devtron/ai-agent :0.0.1	6545dac92173	perl@5.36.0-7+deb12u1	no fix listed	3
quay.io/devtron/argocd-cert-refresh :v10	2b6db27eaf3d	perl@5.34.0-3ubuntu1.1	5.34.0-3ubuntu1.8	3
quay.io/devtron/casbin :172ef62b-9450794d-464-39422	5bf041aacadd	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	3
quay.io/devtron/chart-sync :94237c18-1021-39419	60566529446a	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	3
quay.io/devtron/chart-sync :3b3d6d0e-836-39296	721b5c9634d4	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	3
quay.io/devtron/devtron :9450794d-930-39415	9795f3f9f031	perl@5.38.2-3.2ubuntu0.3	5.38.2-3.2ubuntu0.4	3
quay.io/devtron/google-chat-alert-manager :v2.0.2	39f2c6e0af38	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm3	3
quay.io/devtron/hyperion :0874dcaf-280-39287	01d5d8c4cecb	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	3
quay.io/devtron/inception :7beef376-948-31378	4c3b91bebd3d	perl@5.22.1-9ubuntu0.9	5.22.1-9ubuntu0.9+esm3	3
quay.io/devtron/k8s-utils :807ca3c2-488-14005	f296c2ec5db7	perl@5.34.0-3ubuntu1.1	5.34.0-3ubuntu1.8	3
quay.io/devtron/kubelink :94237c18-314-39417	9d25865295af	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	3
quay.io/devtron/kubelink :09867a9c-564-39289	ea6dd1e4ce71	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	perl@5.36.0-7+deb12u3	no fix listed	3
actualbudget/actual-server :26.9.0	552beab3dec8	perl@5.36.0-7+deb12u3	no fix listed	2
alazidis/kube-netlag :1.1.0	0e8c84152201	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	2
apache/apisix :3.18.0-ubuntu	9ee5df1611f9	perl@5.38.2-3.2ubuntu0.3	5.38.2-3.2ubuntu0.4	2
apache/nifi-registry :1.26.0	7cdfd8deec92	perl@5.34.0-3ubuntu1.3	5.34.0-3ubuntu1.8	2
apache/rocketmq :5.4.0	319cd8a81ed1	perl@5.38.2-3.2ubuntu0.2	5.38.2-3.2ubuntu0.4	2
apache/tika :2.9.2.1-full	ae0b86d3c4d0	perl@5.38.2-3.2build2	5.38.2-3.2ubuntu0.4	2
bitnamilegacy/elasticsearch :9.1.2-debian-12-r0	00176a47afa0	perl@5.36.0-7+deb12u2	no fix listed	2
bitnamilegacy/etcd :latest	99b408c15272	perl@5.36.0-7+deb12u2	no fix listed	2
bitnamilegacy/mariadb :11.4.5-debian-12-r9	33ce23601fc9	perl@5.36.0-7+deb12u1	no fix listed	2
bitnamilegacy/pgpool :4.6.3-debian-12-r0	d3bf3910f148	perl@5.36.0-7+deb12u2	no fix listed	2
bitnamilegacy/postgresql :16.4.0-debian-12-r14	94bc968141e7	perl@5.36.0-7+deb12u1	no fix listed	2
bitnamilegacy/postgresql-repmgr :17.6.0-debian-12-r2	f12387ec882b	perl@5.36.0-7+deb12u2	no fix listed	2
bitnamilegacy/redis :latest	5927ff3702df	perl@5.36.0-7+deb12u2	no fix listed	2
bitnamilegacy/valkey-cluster :8.1.3-debian-12-r3	32869e769b7e	perl@5.36.0-7+deb12u2	no fix listed	2
bitnami/minideb :latest	ab4d5b45116e	perl@5.40.1-6	5.40.1-6+deb13u1	2
blockstack/stacks-core :3.2.0.0.0	f79944317326	perl@5.36.0-7+deb12u2	no fix listed	2
cagriekin/pg-ha :2.0.1-pg18	99e17aa165df	perl@5.40.1-6	5.40.1-6+deb13u1	2
cfssl/cfssl :latest :v1.6.5	c9018c2ddf0b	perl@5.36.0-7+deb12u1	no fix listed	2
chromedp/headless-shell :148.0.7778.97	313ed7255ae1	perl@5.40.1-6	5.40.1-6+deb13u1	2
clickhouse/clickhouse-server :24.2	ed9640bfff07	perl@5.30.0-9ubuntu0.5	5.30.0-9ubuntu0.5+esm3	2
datagrok/grok_connect :latest	f5876d3aebb8	perl@5.34.0-3ubuntu1.7	5.34.0-3ubuntu1.8	2
emberstack/kubernetes-reflector :10.0.65	51dbd5880929	perl@5.38.2-3.2ubuntu0.3	5.38.2-3.2ubuntu0.4	2
eqalpha/keydb :latest	6537505c4235	perl@5.30.0-9ubuntu0.4	5.30.0-9ubuntu0.5+esm3	2
eqalpha/keydb :x86_64_v6.3.4	eceb1806730c	perl@5.30.0-9ubuntu0.4	5.30.0-9ubuntu0.5+esm3	2
fireflyiii/core :version-6.5.9	fe4ecec4c2ba	perl@5.40.1-6	5.40.1-6+deb13u1	2
fireflyiii/data-importer :version-2.2.3	ab52bf932546	perl@5.40.1-6	5.40.1-6+deb13u1	2
freeradius/freeradius-server :3.0.21	21c8bfa904d8	perl@5.26.1-6ubuntu0.3	5.26.1-6ubuntu0.7+esm3	2
geoservercloud/geoserver-cloud-gateway :1.0-RC3	756559ee788a	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm3	2
geoservercloud/geoserver-cloud-rest :1.0-RC3	99540eef78ad	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm3	2
geoservercloud/geoserver-cloud-wcs :1.0-RC3	5c254c53a357	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm3	2
geoservercloud/geoserver-cloud-webui :1.0-RC3	c687b1cbc891	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm3	2
geoservercloud/geoserver-cloud-wfs :1.0-RC3	5288f320cf36	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm3	2
geoservercloud/geoserver-cloud-wms :1.0-RC3	a30a60ac6cd0	perl@5.30.0-9ubuntu0.2	5.30.0-9ubuntu0.5+esm3	2
gjeanmart/safe-ganache-node :latest	926264c8f2d1	perl@5.36.0-7	no fix listed	2