/ 
perl-5.45.1
⭐ Starred 2013 / FIXME
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

FIXME - short description of the security issue, with an identifier of the issue as the manpage name

DESCRIPTION

This document describes the FIXME security vulnerability for perl 5.

Are there any known exploits "in the wild" for this vulnerability

FIXME or delete

Who is particularly vulnerable because of this issue?

FIXME or delete

What is the nature of the vulnerability?

FIXME

What potential exploits are enabled by this vulnerability?

FIXME or delete

Which major versions of perl 5 are affected?

FIXME with a list of versions that are affected, and which were updated.

How can users protect themselves?

FIXME or use the following:

If you are vulnerable, upgrade to the latest maintenance release for the version of perl you are using.

If your release of perl is no longer supported by the perl 5 committers you may need to upgrade to a new major release of perl. The versions currently supported by the perl 5 committers are FIXME 5.28.2 (until 2020-05-31) and FIXME 5.30.1 (until 2021-05-31). The current version of perl is available from https://www.perl.org/get.html .

Who was given access to the information about the vulnerability?

FIXME or use the following:

Specifics about the vulnerability were first disclosed to perl-security, a closed subscriber mailing list that has a subset of the perl committers subcribed to it.

When was the vulnerability discovered?

FIXME

Who discovered the vulnerability?

FIXME

How was the vulnerability reported?

FIXME: something like "So-and-so sent email to perl-security@perl.org"