Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

euleros EulerOS-SA-2026-4081: An update for perl is now available for EulerOS V2.0SP13(x86_64)

euleros EulerOS-SA-2026-4172: An update for perl is now available for EulerOS V2.0SP13

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching
    via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per
    subject position for each participating WHILEM node, so the bit count is the subject length plus one times
    the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a
    286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14,
    leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads
    go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an
    attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt
    heap memory. (CVE-2026-15534)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8736-1 advisory.

    It was discovered that Perl incorrectly handled certain large inputs during regular expression matching.
    An attacker could possibly use this issue to trigger out-of-bounds heap reads or writes, resulting in a     denial of service or arbitrary code execution. (CVE-2026-15534)

    It was discovered that Perl incorrectly handled certain regular expression containing alternative matching     branches. An attacker could

    possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions     being bypassed. (CVE-2026-19487)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching     via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per     subject position for each participating WHILEM node, so the bit count is the subject length plus one times     the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a     286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14,     leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads     go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an     attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt     heap memory. (CVE-2026-15534)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459293	Echo: perl: security update to 5.40.1-6+e16	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459293	Echo: perl: security update to 5.40.1-6+e16	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
344619	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS : Perl vulnerabilities (USN-8736-1)	Nessus	Ubuntu Local Security Checks	Local	medium
333558	Linux Distros Unpatched Vulnerability : CVE-2026-15534	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-15534

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium