Every CVE Search/ Get API key

CVE-2026-15534

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

5.7 MediumFix available

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
High

Exploit likelihood

0.16%Unchanged since Aug 10, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.7

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
CVE-2026-15534
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-190, CWE-125, CWE-787
Updated
2026-11-02
EUVDEUVD-2026-54935 5.7

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
EUVD-2026-54935
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-2cxw-qmfc-3vx3 5.7

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression...

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
GHSA-2cxw-qmfc-3vx3
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 5.7

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
CVE-2026-15534
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-125, CWE-190, CWE-787
Updated
2026-11-02
OSV 5.7

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
CVE-2026-15534
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Weakness
CWE-125, CWE-190, CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-15534 5.7

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
DEBIAN-CVE-2026-15534
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2026-3425 7.5

perl security update

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.(CVE-2026-15534)

Record
OESA-2026-3425
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:63403 5.7

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:63403
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-15534 5.7

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
UBUNTU-CVE-2026-15534
CVSS 3.1
5.7 MediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Updated
2026-11-02
OSVAZL-94670 No score

CVE-2026-15534 affecting package perl for versions less than 5.38.2-516

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

Record
AZL-94670
Updated
2026-11-05
OSVUSN-8736-1 No score

perl vulnerabilities

It was discovered that Perl incorrectly handled certain large inputs during regular expression matching. An attacker could possibly use this issue to trigger out-of-bounds heap reads or writes, resulting in a denial of service or arbitrary code execution. (CVE-2026-15534)

It was discovered that Perl incorrectly handled certain regular expression containing alternative matching branches. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-19487)

Record
USN-8736-1
Updated
2026-11-02
OSVUSN-8736-2 No score

perl vulnerabilities

USN-8736-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 24.04 LTS.

Original advisory details:

It was discovered that Perl incorrectly handled certain large inputs during regular expression matching. An attacker could possibly use this issue to trigger out-of-bounds heap reads or writes, resulting in a denial of service or arbitrary code execution. (CVE-2026-15534)

It was discovered that Perl incorrectly handled certain regular expression containing alternative matching branches. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-19487)

Record
USN-8736-2
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
perl
Azure Linux:3
 before 5.38.2-516
5.38.2-516
perl
Debian:12
 All versions, plus listed versions
5.36.0-105.36.0-75.36.0-7+deb12u15.36.0-7+deb12u25.36.0-7+deb12u3
Show 40 moreShow less
5.36.0-7+deb12u45.36.0-85.36.0-95.38.0-15.38.0-25.38.0~rc2-15.38.2-15.38.2-25.38.2-35.38.2-3.15.38.2-3.25.38.2-3.2+hurd.15.38.2-45.38.2-55.40.0-15.40.0-25.40.0-35.40.0-45.40.0-55.40.0-65.40.0-75.40.0-85.40.0~rc1-15.40.1-15.40.1-25.40.1-35.40.1-45.40.1-55.40.1-65.40.1-75.40.1-85.42.0-15.42.0-25.42.0-35.42.2-15.42.2-25.42.2-35.42.3-15.44.0-15.44.0-2
 None known
perl
Debian:13
 All versions, plus listed versions
5.40.1-65.40.1-6+deb13u15.40.1-75.40.1-85.42.0-1
Show 8 moreShow less
5.42.0-25.42.0-35.42.2-15.42.2-25.42.2-35.42.3-15.44.0-15.44.0-2
 None known
perl
Debian:14
 All versions, plus listed versions
5.40.1-65.40.1-75.40.1-85.42.0-15.42.0-2
Show 7 moreShow less
5.42.0-35.42.2-15.42.2-25.42.2-35.42.3-15.44.0-15.44.0-2
 None known
perl
openEuler:24.03-LTS-SP4
 before 5.38.0-17.oe2403sp4
5.38.0-17.oe2403sp4
perl
openEuler:20.03-LTS-SP4
 before 5.28.3-15.oe2003sp4
5.28.3-15.oe2003sp4
perl
openEuler:22.03-LTS-SP4
 before 5.34.0-18.oe2203sp4
5.34.0-18.oe2203sp4
perl
openEuler:24.03-LTS-SP1
 before 5.38.0-17.oe2403sp1
5.38.0-17.oe2403sp1
perl
openEuler:24.03-LTS-SP3
 before 5.38.0-17.oe2403sp3
5.38.0-17.oe2403sp3
perl
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
Show 115 moreShow less
Affected packages
PackageAffectedFixed
perl-Attribute-Handlers
Red Hat:hummingbird:1
 before 0:1.03-525.1.hum1
0:1.03-525.1.hum1
perl-AutoLoader
Red Hat:hummingbird:1
 before 0:5.74-525.1.hum1
0:5.74-525.1.hum1
perl-AutoSplit
Red Hat:hummingbird:1
 before 0:5.74-525.1.hum1
0:5.74-525.1.hum1
perl-B
Red Hat:hummingbird:1
 before 0:1.89-525.1.hum1
0:1.89-525.1.hum1
perl-Benchmark
Red Hat:hummingbird:1
 before 0:1.27-525.1.hum1
0:1.27-525.1.hum1
perl-Class-Struct
Red Hat:hummingbird:1
 before 0:0.68-525.1.hum1
0:0.68-525.1.hum1
perl-Config-Extensions
Red Hat:hummingbird:1
 before 0:0.03-525.1.hum1
0:0.03-525.1.hum1
perl-DBM_Filter
Red Hat:hummingbird:1
 before 0:0.07-525.1.hum1
0:0.07-525.1.hum1
perl-Devel-Peek
Red Hat:hummingbird:1
 before 0:1.36-525.1.hum1
0:1.36-525.1.hum1
perl-Devel-SelfStubber
Red Hat:hummingbird:1
 before 0:1.06-525.1.hum1
0:1.06-525.1.hum1
perl-DirHandle
Red Hat:hummingbird:1
 before 0:1.05-525.1.hum1
0:1.05-525.1.hum1
perl-Dumpvalue
Red Hat:hummingbird:1
 before 0:2.27-525.1.hum1
0:2.27-525.1.hum1
perl-DynaLoader
Red Hat:hummingbird:1
 before 0:1.57-525.1.hum1
0:1.57-525.1.hum1
perl-English
Red Hat:hummingbird:1
 before 0:1.11-525.1.hum1
0:1.11-525.1.hum1
perl-Errno
Red Hat:hummingbird:1
 before 0:1.38-525.1.hum1
0:1.38-525.1.hum1
perl-ExtUtils-Constant
Red Hat:hummingbird:1
 before 0:0.25-525.1.hum1
0:0.25-525.1.hum1
perl-ExtUtils-Embed
Red Hat:hummingbird:1
 before 0:1.35-525.1.hum1
0:1.35-525.1.hum1
perl-ExtUtils-Miniperl
Red Hat:hummingbird:1
 before 0:1.14-525.1.hum1
0:1.14-525.1.hum1
perl-Fcntl
Red Hat:hummingbird:1
 before 0:1.20-525.1.hum1
0:1.20-525.1.hum1
perl-File-Basename
Red Hat:hummingbird:1
 before 0:2.86-525.1.hum1
0:2.86-525.1.hum1
perl-File-Compare
Red Hat:hummingbird:1
 before 0:1.100.800-525.1.hum1
0:1.100.800-525.1.hum1
perl-File-Copy
Red Hat:hummingbird:1
 before 0:2.41-525.1.hum1
0:2.41-525.1.hum1
perl-File-DosGlob
Red Hat:hummingbird:1
 before 0:1.12-525.1.hum1
0:1.12-525.1.hum1
perl-File-Find
Red Hat:hummingbird:1
 before 0:1.44-525.1.hum1
0:1.44-525.1.hum1
perl-File-stat
Red Hat:hummingbird:1
 before 0:1.14-525.1.hum1
0:1.14-525.1.hum1
perl-FileCache
Red Hat:hummingbird:1
 before 0:1.10-525.1.hum1
0:1.10-525.1.hum1
perl-FileHandle
Red Hat:hummingbird:1
 before 0:2.05-525.1.hum1
0:2.05-525.1.hum1
perl-FindBin
Red Hat:hummingbird:1
 before 0:1.54-525.1.hum1
0:1.54-525.1.hum1
perl-GDBM_File
Red Hat:hummingbird:1
 before 0:1.24-525.1.hum1
0:1.24-525.1.hum1
perl-Getopt-Std
Red Hat:hummingbird:1
 before 0:1.14-525.1.hum1
0:1.14-525.1.hum1
perl-Hash-Util
Red Hat:hummingbird:1
 before 0:0.32-525.1.hum1
0:0.32-525.1.hum1
perl-Hash-Util-FieldHash
Red Hat:hummingbird:1
 before 0:1.27-525.1.hum1
0:1.27-525.1.hum1
perl-I18N-Collate
Red Hat:hummingbird:1
 before 0:1.02-525.1.hum1
0:1.02-525.1.hum1
perl-I18N-LangTags
Red Hat:hummingbird:1
 before 0:0.45-525.1.hum1
0:0.45-525.1.hum1
perl-I18N-Langinfo
Red Hat:hummingbird:1
 before 0:0.24-525.1.hum1
0:0.24-525.1.hum1
perl-IO
Red Hat:hummingbird:1
 before 0:1.55-525.1.hum1
0:1.55-525.1.hum1
perl-IPC-Open3
Red Hat:hummingbird:1
 before 0:1.24-525.1.hum1
0:1.24-525.1.hum1
perl-Locale-Maketext-Simple
Red Hat:hummingbird:1
 before 0:0.21-525.1.hum1
0:0.21-525.1.hum1
perl-Math-Complex
Red Hat:hummingbird:1
 before 0:1.63-525.1.hum1
0:1.63-525.1.hum1
perl-Memoize
Red Hat:hummingbird:1
 before 0:1.17-525.1.hum1
0:1.17-525.1.hum1
perl-Module-Loaded
Red Hat:hummingbird:1
 before 0:0.08-525.1.hum1
0:0.08-525.1.hum1
perl-NDBM_File
Red Hat:hummingbird:1
 before 0:1.18-525.1.hum1
0:1.18-525.1.hum1
perl-NEXT
Red Hat:hummingbird:1
 before 0:0.69-525.1.hum1
0:0.69-525.1.hum1
perl-Net
Red Hat:hummingbird:1
 before 0:1.04-525.1.hum1
0:1.04-525.1.hum1
perl-ODBM_File
Red Hat:hummingbird:1
 before 0:1.20-525.1.hum1
0:1.20-525.1.hum1
perl-Opcode
Red Hat:hummingbird:1
 before 0:1.69-525.1.hum1
0:1.69-525.1.hum1
perl-POSIX
Red Hat:hummingbird:1
 before 0:2.23-525.1.hum1
0:2.23-525.1.hum1
perl-Pod-Functions
Red Hat:hummingbird:1
 before 0:1.14-525.1.hum1
0:1.14-525.1.hum1
perl-Pod-Html
Red Hat:hummingbird:1
 before 0:1.35-525.1.hum1
0:1.35-525.1.hum1
perl-Safe
Red Hat:hummingbird:1
 before 0:2.47-525.1.hum1
0:2.47-525.1.hum1
perl-Search-Dict
Red Hat:hummingbird:1
 before 0:1.08-525.1.hum1
0:1.08-525.1.hum1
perl-SelectSaver
Red Hat:hummingbird:1
 before 0:1.02-525.1.hum1
0:1.02-525.1.hum1
perl-SelfLoader
Red Hat:hummingbird:1
 before 0:1.28-525.1.hum1
0:1.28-525.1.hum1
perl-Symbol
Red Hat:hummingbird:1
 before 0:1.09-525.1.hum1
0:1.09-525.1.hum1
perl-Sys-Hostname
Red Hat:hummingbird:1
 before 0:1.25-525.1.hum1
0:1.25-525.1.hum1
perl-Term-Complete
Red Hat:hummingbird:1
 before 0:1.403-525.1.hum1
0:1.403-525.1.hum1
perl-Term-ReadLine
Red Hat:hummingbird:1
 before 0:1.17-525.1.hum1
0:1.17-525.1.hum1
perl-Test
Red Hat:hummingbird:1
 before 0:1.31-525.1.hum1
0:1.31-525.1.hum1
perl-Text-Abbrev
Red Hat:hummingbird:1
 before 0:1.02-525.1.hum1
0:1.02-525.1.hum1
perl-Thread
Red Hat:hummingbird:1
 before 0:3.06-525.1.hum1
0:3.06-525.1.hum1
perl-Thread-Semaphore
Red Hat:hummingbird:1
 before 0:2.13-525.1.hum1
0:2.13-525.1.hum1
perl-Tie
Red Hat:hummingbird:1
 before 0:4.6-525.1.hum1
0:4.6-525.1.hum1
perl-Tie-File
Red Hat:hummingbird:1
 before 0:1.10-525.1.hum1
0:1.10-525.1.hum1
perl-Tie-Memoize
Red Hat:hummingbird:1
 before 0:1.1-525.1.hum1
0:1.1-525.1.hum1
perl-Time
Red Hat:hummingbird:1
 before 0:1.04-525.1.hum1
0:1.04-525.1.hum1
perl-Time-Piece
Red Hat:hummingbird:1
 before 0:1.3600-525.1.hum1
0:1.3600-525.1.hum1
perl-Unicode-UCD
Red Hat:hummingbird:1
 before 0:0.81-525.1.hum1
0:0.81-525.1.hum1
perl-User-pwent
Red Hat:hummingbird:1
 before 0:1.05-525.1.hum1
0:1.05-525.1.hum1
perl-autouse
Red Hat:hummingbird:1
 before 0:1.11-525.1.hum1
0:1.11-525.1.hum1
perl-base
Red Hat:hummingbird:1
 before 0:2.27-525.1.hum1
0:2.27-525.1.hum1
perl-blib
Red Hat:hummingbird:1
 before 0:1.07-525.1.hum1
0:1.07-525.1.hum1
perl-debugger
Red Hat:hummingbird:1
 before 0:1.60-525.1.hum1
0:1.60-525.1.hum1
perl-deprecate
Red Hat:hummingbird:1
 before 0:0.04-525.1.hum1
0:0.04-525.1.hum1
perl-devel
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-diagnostics
Red Hat:hummingbird:1
 before 0:1.40-525.1.hum1
0:1.40-525.1.hum1
perl-doc
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-encoding-warnings
Red Hat:hummingbird:1
 before 0:0.14-525.1.hum1
0:0.14-525.1.hum1
perl-fields
Red Hat:hummingbird:1
 before 0:2.27-525.1.hum1
0:2.27-525.1.hum1
perl-filetest
Red Hat:hummingbird:1
 before 0:1.03-525.1.hum1
0:1.03-525.1.hum1
perl-if
Red Hat:hummingbird:1
 before 0:0.61.000-525.1.hum1
0:0.61.000-525.1.hum1
perl-interpreter
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-less
Red Hat:hummingbird:1
 before 0:0.03-525.1.hum1
0:0.03-525.1.hum1
perl-lib
Red Hat:hummingbird:1
 before 0:0.65-525.1.hum1
0:0.65-525.1.hum1
perl-libnetcfg
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-libs
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-locale
Red Hat:hummingbird:1
 before 0:1.13-525.1.hum1
0:1.13-525.1.hum1
perl-macros
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-meta-notation
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-mro
Red Hat:hummingbird:1
 before 0:1.29-525.1.hum1
0:1.29-525.1.hum1
perl-open
Red Hat:hummingbird:1
 before 0:1.13-525.1.hum1
0:1.13-525.1.hum1
perl-overload
Red Hat:hummingbird:1
 before 0:1.40-525.1.hum1
0:1.40-525.1.hum1
perl-overloading
Red Hat:hummingbird:1
 before 0:0.02-525.1.hum1
0:0.02-525.1.hum1
perl-ph
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-sigtrap
Red Hat:hummingbird:1
 before 0:1.10-525.1.hum1
0:1.10-525.1.hum1
perl-sort
Red Hat:hummingbird:1
 before 0:2.06-525.1.hum1
0:2.06-525.1.hum1
perl-subs
Red Hat:hummingbird:1
 before 0:1.04-525.1.hum1
0:1.04-525.1.hum1
perl-tests
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-utils
Red Hat:hummingbird:1
 before 0:5.42.2-525.1.hum1
0:5.42.2-525.1.hum1
perl-vars
Red Hat:hummingbird:1
 before 0:1.05-525.1.hum1
0:1.05-525.1.hum1
perl-vmsish
Red Hat:hummingbird:1
 before 0:1.04-525.1.hum1
0:1.04-525.1.hum1
perl
Ubuntu:Pro:14.04:LTS
 before 5.18.2-2ubuntu1.7+esm9, plus listed versions
5.14.2-21build15.18.1-45.18.1-4build15.18.1-55.18.2-2
Show 11 moreShow less
5.18.2-2ubuntu15.18.2-2ubuntu1.15.18.2-2ubuntu1.35.18.2-2ubuntu1.45.18.2-2ubuntu1.65.18.2-2ubuntu1.75.18.2-2ubuntu1.7+esm35.18.2-2ubuntu1.7+esm45.18.2-2ubuntu1.7+esm55.18.2-2ubuntu1.7+esm75.18.2-2ubuntu1.7+esm8
5.18.2-2ubuntu1.7+esm9
perl
Ubuntu:Pro:16.04:LTS
 before 5.22.1-9ubuntu0.9+esm4, plus listed versions
5.20.2-65.22.1-35.22.1-45.22.1-55.22.1-7
Show 10 moreShow less
5.22.1-85.22.1-95.22.1-9ubuntu0.25.22.1-9ubuntu0.35.22.1-9ubuntu0.55.22.1-9ubuntu0.65.22.1-9ubuntu0.95.22.1-9ubuntu0.9+esm15.22.1-9ubuntu0.9+esm25.22.1-9ubuntu0.9+esm3
5.22.1-9ubuntu0.9+esm4
perl
Ubuntu:Pro:18.04:LTS
 before 5.26.1-6ubuntu0.7+esm4, plus listed versions
5.26.0-8ubuntu15.26.1-2ubuntu15.26.1-35.26.1-45.26.1-4build1
Show 10 moreShow less
5.26.1-55.26.1-65.26.1-6ubuntu0.15.26.1-6ubuntu0.25.26.1-6ubuntu0.35.26.1-6ubuntu0.55.26.1-6ubuntu0.65.26.1-6ubuntu0.75.26.1-6ubuntu0.7+esm25.26.1-6ubuntu0.7+esm3
5.26.1-6ubuntu0.7+esm4
perl
Ubuntu:Pro:20.04:LTS
 before 5.30.0-9ubuntu0.5+esm4, plus listed versions
5.28.1-6build15.30.0-75.30.0-95.30.0-9build15.30.0-9ubuntu0.2
Show 5 moreShow less
5.30.0-9ubuntu0.35.30.0-9ubuntu0.45.30.0-9ubuntu0.55.30.0-9ubuntu0.5+esm25.30.0-9ubuntu0.5+esm3
5.30.0-9ubuntu0.5+esm4
perl
Ubuntu:22.04:LTS
 before 5.34.0-3ubuntu1.9, plus listed versions
5.32.1-3ubuntu35.34.0-3ubuntu15.34.0-3ubuntu1.15.34.0-3ubuntu1.25.34.0-3ubuntu1.3
Show 4 moreShow less
5.34.0-3ubuntu1.45.34.0-3ubuntu1.55.34.0-3ubuntu1.75.34.0-3ubuntu1.8
5.34.0-3ubuntu1.9
perl
Ubuntu:24.04:LTS
 before 5.38.2-3.2ubuntu0.6, plus listed versions
5.36.0-9ubuntu15.36.0-10ubuntu15.38.2-35.38.2-3.25.38.2-3.2build1
Show 6 moreShow less
5.38.2-3.2build25.38.2-3.2build2.15.38.2-3.2ubuntu0.15.38.2-3.2ubuntu0.25.38.2-3.2ubuntu0.35.38.2-3.2ubuntu0.4
5.38.2-3.2ubuntu0.6
perl
Ubuntu:26.10
 All versions, plus listed versions
5.40.1-7build15.40.1-85.40.1-8ubuntu15.42.3-1
 None known
perl
Ubuntu:26.04:LTS
 before 5.40.1-7ubuntu0.2, plus listed versions
5.40.1-6build15.40.1-7build15.40.1-7ubuntu0.1
5.40.1-7ubuntu0.2
perl
Ubuntu:Pro:14.04:LTS
From an advisory covering 2 CVEs
 before 5.18.2-2ubuntu1.7+esm9, plus listed versions
5.14.2-21build15.18.1-45.18.1-4build15.18.1-55.18.2-2
Show 11 moreShow less
5.18.2-2ubuntu15.18.2-2ubuntu1.15.18.2-2ubuntu1.35.18.2-2ubuntu1.45.18.2-2ubuntu1.65.18.2-2ubuntu1.75.18.2-2ubuntu1.7+esm35.18.2-2ubuntu1.7+esm45.18.2-2ubuntu1.7+esm55.18.2-2ubuntu1.7+esm75.18.2-2ubuntu1.7+esm8
5.18.2-2ubuntu1.7+esm9
perl
Ubuntu:Pro:16.04:LTS
From an advisory covering 2 CVEs
 before 5.22.1-9ubuntu0.9+esm4, plus listed versions
5.20.2-65.22.1-35.22.1-45.22.1-55.22.1-7
Show 10 moreShow less
5.22.1-85.22.1-95.22.1-9ubuntu0.25.22.1-9ubuntu0.35.22.1-9ubuntu0.55.22.1-9ubuntu0.65.22.1-9ubuntu0.95.22.1-9ubuntu0.9+esm15.22.1-9ubuntu0.9+esm25.22.1-9ubuntu0.9+esm3
5.22.1-9ubuntu0.9+esm4
perl
Ubuntu:Pro:18.04:LTS
From an advisory covering 2 CVEs
 before 5.26.1-6ubuntu0.7+esm4, plus listed versions
5.26.0-8ubuntu15.26.1-2ubuntu15.26.1-35.26.1-45.26.1-4build1
Show 10 moreShow less
5.26.1-55.26.1-65.26.1-6ubuntu0.15.26.1-6ubuntu0.25.26.1-6ubuntu0.35.26.1-6ubuntu0.55.26.1-6ubuntu0.65.26.1-6ubuntu0.75.26.1-6ubuntu0.7+esm25.26.1-6ubuntu0.7+esm3
5.26.1-6ubuntu0.7+esm4
perl
Ubuntu:Pro:20.04:LTS
From an advisory covering 2 CVEs
 before 5.30.0-9ubuntu0.5+esm4, plus listed versions
5.28.1-6build15.30.0-75.30.0-95.30.0-9build15.30.0-9ubuntu0.2
Show 5 moreShow less
5.30.0-9ubuntu0.35.30.0-9ubuntu0.45.30.0-9ubuntu0.55.30.0-9ubuntu0.5+esm25.30.0-9ubuntu0.5+esm3
5.30.0-9ubuntu0.5+esm4
perl
Ubuntu:22.04:LTS
From an advisory covering 2 CVEs
 before 5.34.0-3ubuntu1.9, plus listed versions
5.32.1-3ubuntu35.34.0-3ubuntu15.34.0-3ubuntu1.15.34.0-3ubuntu1.25.34.0-3ubuntu1.3
Show 4 moreShow less
5.34.0-3ubuntu1.45.34.0-3ubuntu1.55.34.0-3ubuntu1.75.34.0-3ubuntu1.8
5.34.0-3ubuntu1.9
perl
Ubuntu:26.04:LTS
From an advisory covering 2 CVEs
 before 5.40.1-7ubuntu0.2, plus listed versions
5.40.1-6build15.40.1-7build15.40.1-7ubuntu0.1
5.40.1-7ubuntu0.2
perl
Ubuntu:24.04:LTS
From an advisory covering 2 CVEs
 before 5.38.2-3.2ubuntu0.6, plus listed versions
5.36.0-9ubuntu15.36.0-10ubuntu15.38.2-35.38.2-3.25.38.2-3.2build1
Show 6 moreShow less
5.38.2-3.2build25.38.2-3.2build2.15.38.2-3.2ubuntu0.15.38.2-3.2ubuntu0.25.38.2-3.2ubuntu0.35.38.2-3.2ubuntu0.4
5.38.2-3.2ubuntu0.6

History

History
RecordedChangedSources
affected
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-15534 is a medium vulnerability (CVSS 5.7) in perl, published August 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. Fixed in perl 5.38.2-516.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open