Version in base suite: 1.14-2 Base version: libtie-hash-regex-perl_1.14-2 Target version: libtie-hash-regex-perl_1.14-3~deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/libt/libtie-hash-regex-perl/libtie-hash-regex-perl_1.14-2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/libt/libtie-hash-regex-perl/libtie-hash-regex-perl_1.14-3~deb13u1.dsc changelog | 14 ++ patches/Fix-CVE-2026-77781.patch | 225 +++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 240 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpixqmelp8/libtie-hash-regex-perl_1.14-2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpixqmelp8/libtie-hash-regex-perl_1.14-3~deb13u1.dsc: no acceptable signature found diff -Nru libtie-hash-regex-perl-1.14/debian/changelog libtie-hash-regex-perl-1.14/debian/changelog --- libtie-hash-regex-perl-1.14/debian/changelog 2022-10-15 16:59:51.000000000 +0000 +++ libtie-hash-regex-perl-1.14/debian/changelog 2026-09-05 12:19:30.000000000 +0000 @@ -1,3 +1,17 @@ +libtie-hash-regex-perl (1.14-3~deb13u1) trixie; urgency=medium + + * Rebuild for trixie + + -- Salvatore Bonaccorso Sat, 05 Sep 2026 14:19:30 +0200 + +libtie-hash-regex-perl (1.14-3) unstable; urgency=medium + + * Team upload. + * Tie::Hash::Regex throws an exception on unparseable lookup keys + (CVE-2026-77781) + + -- Salvatore Bonaccorso Sat, 22 Aug 2026 13:56:22 +0200 + libtie-hash-regex-perl (1.14-2) unstable; urgency=medium [ Debian Janitor ] diff -Nru libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch --- libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch 1970-01-01 00:00:00.000000000 +0000 +++ libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch 2026-09-05 12:19:30.000000000 +0000 @@ -0,0 +1,225 @@ +From: Dave Cross +Date: Fri, 21 Aug 2026 13:41:51 +0100 +Subject: Fix CVE-2026-77781 +Origin: https://github.com/davorg-cpan/tie-hash-regex/commit/4239732cb76233543e2ded8ff5e0f238af152e0c +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-77781 + +[Salvatore Bonaccorso: Drop version bump to 2.0.0 in module] +--- + Changes | 6 ++ + lib/Tie/Hash/Regex.pm | 20 ++++-- + t/cvs-2026-77781.t | 152 ++++++++++++++++++++++++++++++++++++++++++ + 3 files changed, 174 insertions(+), 4 deletions(-) + create mode 100644 t/cvs-2026-77781.t + +diff --git a/lib/Tie/Hash/Regex.pm b/lib/Tie/Hash/Regex.pm +index 2b9492cfe473..faffd02356e8 100644 +--- a/lib/Tie/Hash/Regex.pm ++++ b/lib/Tie/Hash/Regex.pm +@@ -100,7 +100,8 @@ sub FETCH { + + return $self->{$key} if !$is_re && exists $self->{$key}; + +- $key = qr/$key/ unless $is_re; ++ $key = _compile($key) unless $is_re; ++ return unless defined $key; + + # NOTE: wantarray will _never_ be true when FETCH is called + # using the standard hash semantics. I've put that piece +@@ -130,7 +131,8 @@ sub EXISTS { + + return 1 if !$is_re && exists $self->{$key}; + +- $key = qr/$key/ unless $is_re; ++ $key = _compile($key) unless $is_re; ++ return unless defined $key; + + /$key/ && return 1 for keys %$self; + +@@ -152,7 +154,8 @@ sub DELETE { + + return delete $self->{$key} if !$is_re && exists $self->{$key}; + +- $key = qr/$key/ unless $is_re; ++ $key = _compile($key) unless $is_re; ++ return unless defined $key; + + for (keys %$self) { + if (/$key/) { +@@ -161,6 +164,15 @@ sub DELETE { + } + } + ++sub _compile { ++ my ($key) = @_; ++ ++ my $re = eval { qr/$key/ }; ++ ++ # This will be undef if the "eval" failed ++ return $re; ++} ++ + 1; + __END__ + +diff --git a/t/cvs-2026-77781.t b/t/cvs-2026-77781.t +new file mode 100644 +index 000000000000..22a1bcf3b699 +--- /dev/null ++++ b/t/cvs-2026-77781.t +@@ -0,0 +1,152 @@ ++use strict; ++use warnings; ++ ++use Test::More; ++ ++use Tie::Hash::Regex; ++ ++sub fresh { ++ my %h; ++ ++ tie %h, 'Tie::Hash::Regex'; ++ ++ $h{alice} = 'record-A'; ++ $h{bob} = 'record-B'; ++ $h{carol} = 'record-C'; ++ ++ return \%h; ++} ++ ++# ++# First make sure the normal behaviour still works. ++# ++ ++{ ++ my $h = fresh(); ++ ++ is( ++ $h->{alice}, ++ 'record-A', ++ 'exact lookup works', ++ ); ++ ++ is( ++ $h->{'^car'}, ++ 'record-C', ++ 'regex lookup works', ++ ); ++ ++ is( ++ $h->{'^zzz'}, ++ undef, ++ 'well-formed regex with no match returns undef', ++ ); ++} ++ ++# ++# Regression tests for CVE-2026-77781. ++# ++# A malformed regex used as a lookup key should be treated as a ++# non-match, rather than throwing an exception from FETCH, EXISTS ++# or DELETE. ++# ++ ++my @payloads = ( ++ '(', ++ '[', ++ '*', ++ '+', ++ '?', ++ '\\', ++ '(?<', ++ '(?{', ++); ++ ++for my $payload (@payloads) { ++ subtest "malformed pattern '$payload'" => sub { ++ { ++ my $h = fresh(); ++ ++ my ($value, $error); ++ ++ { ++ local $@; ++ eval { ++ $value = $h->{$payload}; ++ 1; ++ } or $error = $@; ++ } ++ ++ is( ++ $error, ++ undef, ++ 'FETCH does not die', ++ ); ++ ++ is( ++ $value, ++ undef, ++ 'FETCH treats malformed pattern as no match', ++ ); ++ } ++ ++ { ++ my $h = fresh(); ++ ++ my ($exists, $error); ++ ++ { ++ local $@; ++ eval { ++ $exists = exists $h->{$payload}; ++ 1; ++ } or $error = $@; ++ } ++ ++ is( ++ $error, ++ undef, ++ 'EXISTS does not die', ++ ); ++ ++ ok( ++ !$exists, ++ 'EXISTS treats malformed pattern as no match', ++ ); ++ } ++ ++ { ++ my $h = fresh(); ++ ++ my ($deleted, $error); ++ ++ { ++ local $@; ++ eval { ++ $deleted = delete $h->{$payload}; ++ 1; ++ } or $error = $@; ++ } ++ ++ is( ++ $error, ++ undef, ++ 'DELETE does not die', ++ ); ++ ++ is( ++ $deleted, ++ undef, ++ 'DELETE treats malformed pattern as no match', ++ ); ++ ++ is_deeply( ++ [sort keys %$h], ++ [qw(alice bob carol)], ++ 'failed DELETE leaves hash unchanged', ++ ); ++ } ++ }; ++} ++ ++done_testing; +-- +2.55.0 + diff -Nru libtie-hash-regex-perl-1.14/debian/patches/series libtie-hash-regex-perl-1.14/debian/patches/series --- libtie-hash-regex-perl-1.14/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ libtie-hash-regex-perl-1.14/debian/patches/series 2026-09-05 12:19:30.000000000 +0000 @@ -0,0 +1 @@ +Fix-CVE-2026-77781.patch