Perl Heap OOB in Regex Engine Through 5.45.1

CVE-2026-15534. Published to NVD on August 9, 2026. Perl through 5.45.1. Heap out-of-bounds reads and writes during regex matching. Patch commit exists in the upstream tree. CVSS: not yet assigned.

The mechanism — confirmed

The bug is in S_regmatch(), Perl’s regex evaluation core. During backtracking, the engine maintains a superlinear cache: one bit per subject position per WHILEM node encountered. The cache size is computed as (subject_length + 1) × node_count, stored as a signed 32-bit integer with no overflow check. A 286,331,153-byte subject matched against a pattern with 15 participating WHILEM nodes overflows that signed integer, producing a count of 14 — leaving a two-byte allocation. The engine then indexes from the actual match position and node number, writing past the end of the cache. On success paths, this produces heap OOB reads; on failure, CACHEsayNO sets a bit past the allocation.

NVD description: “A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.”

Attacker control requirements

The attacker must supply or influence the subject being matched. That surface is not trivial, but it is common. Log processors, CGI handlers, input validators, configuration file parsers, and templating engines — any Perl application that routes externally sourced strings into a regex with WHILEM nodes is in scope. The input must be approximately 286MB to trigger the overflow. That is not a casual attack, but it is within reach for adversaries with access to upload paths, API endpoints, or other high-throughput input vectors.

Perl remains deeply embedded in mail transport, systems administration tooling, and legacy web infrastructure. Applications that have not bounded input size before regex evaluation are the primary risk.

Patch status

A patch commit is in the perl5 upstream repository. Distribution packages have not yet propagated as of publication. NVD has not assigned a CVSS score or severity bucket — that analysis is in progress. Until it is complete, severity is unclassified. The NVD description characterizes the outcome as process crash or heap memory corruption on attacker-controlled input, which merits attention at any eventual score.

Full NVD entry: CVE-2026-15534.

What to check

If you operate Perl applications that accept external input and pass it through regex patterns:

• Check your deployed Perl version. Versions through 5.45.1 are confirmed affected.
• Track your Linux distribution’s Perl package update channel for a backport of the patch commit.
• As an interim control, bound input length before passing to complex regex patterns — any input that will not legitimately exceed a few megabytes should be rejected before it reaches the regex engine.

No active exploitation has been reported. Unconfirmed — treat accordingly.

Memory safety vulnerabilities in widely-deployed scripting runtimes follow a familiar arc: disclosed quietly, scored slowly, patched in upstream before distributions ship it. The Linux kernel LPE in epoll landed the same way earlier this year. The window between upstream patch and distribution package is the risk window; knowing it is open is the point of tracking this at publication.