CVE-2026-3031 - Vulnerability Details - OpenCVE

Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Tokuhirom	Image::epeg

No data.

No data.

References

Link	Providers
https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.readme
https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.tar.gz
https://sourceforge.net/projects/enlightenment/files/OldFiles/epeg-0.9.0.tar.gz/download

History

Thu, 23 Jul 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Tokuhirom Tokuhirom image::epeg
Vendors & Products		Tokuhirom Tokuhirom image::epeg

Thu, 16 Jul 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library. Image::EPEG includes Epeg 0.9.0 that was last updated in 2004. Epeg is a fast JPEG thumbnail library that was once part of the Englightenment Project.
Title		Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library
Weaknesses		CWE-1104
References		https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.readme https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.tar.gz https://sourceforge.net/projects/enlightenment/files/OldFiles/epeg-0.9.0.tar.gz/download

MITRE

Status: PUBLISHED

Assigner: CPANSec

Published: 2026-07-16T16:22:38.557Z

Updated: 2026-07-17T18:07:02.432Z

Reserved: 2026-02-23T14:42:48.259Z

Link: CVE-2026-3031

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2026-07-16T17:16:55.633

Modified: 2026-07-17T19:17:13.403

Link: CVE-2026-3031

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3031", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-02-23T14:42:48.259Z", "datePublished": "2026-07-16T16:22:38.557Z", "dateUpdated": "2026-07-17T18:07:02.432Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Image-EPEG", "product": "Image::EPEG", "programFiles": ["epeg/src/lib/epeg_main.c"], "vendor": "TOKUHIROM", "versions": [{"lessThanOrEqual": "0.15", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library.\n\nImage::EPEG includes Epeg 0.9.0 that was last updated in 2004.\n\nEpeg is a fast JPEG thumbnail library that was once part of the Englightenment Project."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1104", "description": "CWE-1104 Use of Unmaintained Third Party Components", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-16T16:22:38.557Z"}, "references": [{"url": "https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.readme"}, {"url": "https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.tar.gz"}, {"url": "https://sourceforge.net/projects/enlightenment/files/OldFiles/epeg-0.9.0.tar.gz/download"}], "source": {"discovery": "UNKNOWN"}, "title": "Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library", "workarounds": [{"lang": "en", "value": "Image::EPEG has been deprecated since version 0.14 and has been removed from CPAN. Migrate to a different solution."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T17:34:45.451295Z", "id": "CVE-2026-3031", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T18:07:02.432Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Image-EPEG", "product": "Image::EPEG", "programFiles": ["epeg/src/lib/epeg_main.c"], "vendor": "TOKUHIROM", "versions": [{"lessThanOrEqual": "0.15", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg library.\n\nImage::EPEG includes Epeg 0.9.0 that was last updated in 2004.\n\nEpeg is a fast JPEG thumbnail library that was once part of the Englightenment Project."}], "id": "CVE-2026-3031", "lastModified": "2026-07-17T19:17:13.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3031", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T17:34:45.451295Z", "version": "2.0.3"}}]}, "published": "2026-07-16T17:16:55.633", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.readme"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://backpan.metacpan.org/authors/id/T/TO/TOKUHIROM/Image-Epeg-0.15.tar.gz"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://sourceforge.net/projects/enlightenment/files/OldFiles/epeg-0.9.0.tar.gz/download"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1104"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}