/ 
perl-5.45.1
⭐ Starred 2013 / perlivp
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

perlivp - Perl Installation Verification Procedure

SYNOPSIS

perlivp [-p] [-v] [-h]

DESCRIPTION

The perlivp program is set up at Perl source code build time to test the Perl version it was built under. It can be used after running:

make install

(or your platform's equivalent procedure) to verify that perl and its libraries have been installed correctly. A correct installation is verified by output that looks like:

ok 1
ok 2

etc.

OPTIONS

-h help

Prints out a brief help message.

-p print preface

Gives a description of each test prior to performing it.

-v verbose

Gives more detailed information about each test, after it has been performed. Note that any failed tests ought to print out some extra information whether or not -v is thrown.

DIAGNOSTICS

  • print "# Perl binary '$perlpath' does not appear executable.\n";

    Likely to occur for a perl binary that was not properly installed. Correct by conducting a proper installation.

  • print "# Perl version '$]' installed, expected $ivp_VERSION.\n";

    Likely to occur for a perl that was not properly installed. Correct by conducting a proper installation.

  • print "# Perl \@INC directory '$_' does not appear to exist.\n";

    Likely to occur for a perl library tree that was not properly installed. Correct by conducting a proper installation.

  • print "# Needed module '$_' does not appear to be properly installed.\n";

    One of the two modules that is used by perlivp was not present in the installation. This is a serious error since it adversely affects perlivp's ability to function. You may be able to correct this by performing a proper perl installation.

  • print "# Required module '$_' does not appear to be properly installed.\n";

    An attempt to eval "require $module" failed, even though the list of extensions indicated that it should succeed. Correct by conducting a proper installation.

  • print "# Unnecessary module 'bLuRfle' appears to be installed.\n";

    This test not coming out ok could indicate that you have in fact installed a bLuRfle.pm module or that the eval " require \"$module_name.pm\"; " test may give misleading results with your installation of perl. If yours is the latter case then please let the author know.

  • print "# file",+($#missing == 0) ? '' : 's'," missing from installation:\n";

    One or more files turned up missing according to a run of ExtUtils::Installed -> validate() over your installation. Correct by conducting a proper installation.

For further information on how to conduct a proper installation consult the INSTALL file that comes with the perl source and the README file for your platform.

AUTHOR

Peter Prymmer