CVE-2026-57433 involves a signed integer overflow in Storable versions before 3.41 for Perl when deserializing a crafted SX_HOOK record. The issue arises from retrieve_hook_common reading a signed 32-bit item count from an SX_HOOK record and calling av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value. A crafted blob passed to thaw or retrieve triggers the overflow [truncated]
HTTP::Tiny versions before 0.095 for Perl contain a vulnerability that forwards credential headers to cross-origin redirect targets. When a server returns a 3xx redirect, the `_maybe_redirect` function follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request without checking whether the redirect target shares an origin with the original UR [truncated]
