Summary
It was discovered that Perl incorrectly handled certain large inputs during
regular expression matching. An attacker could possibly use this issue to
trigger out-of-bounds heap reads or writes, resulting in a denial of
service or arbitrary code execution. (CVE-2026-15534)
It was discovered that Perl incorrectly handled certain regular expression
containing alternative matching branches. An attacker could possibly use
this issue to cause incorrect regular expression matches, resulting in
security restrictions being bypassed. (CVE-2026-19487)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | perl | 5.34.0-3ubuntu1.9 |
| Ubuntu · 26.04 LTS 26.04:LTS | perl | 5.40.1-7ubuntu0.2 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | perl | 5.18.2-2ubuntu1.7+esm9 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | perl | 5.22.1-9ubuntu0.9+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | perl | 5.26.1-6ubuntu0.7+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | perl | 5.30.0-9ubuntu0.5+esm4 |
Vulnerabilities 2
-
Medium 5.7
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch
Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM n…
-
Medium 5.3
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the …