Scott Baker

**Name of the Vulnerable Software and Affected Versions** String::Util versions prior to 1.36 **Description** String::Util for Perl is susceptible to a regular expression denial of service. The `trim()` and `rtrim()` functions use a regular expression to strip trailing whitespace. Because the `s*` pattern matches greedily and the `$` anchor fails when a non-whitespace character follows the whitespace, the regex engine performs quadratic backtracking on long whitespace runs. An attacker providing untrusted input containing a long sequence of whitespace to these functions can cause CPU exhaustion. **Recommendations** Update String::Util to version 1.36 or later. As a temporary workaround, restrict the use of the `trim()` and `rtrim()` functions when processing untrusted input.