https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 14:04:44 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/euvd-2026-365374 EUVD-2026-365374 https://cve.radiocsirt.org/vuln/euvd-2026-365374 https://cve.radiocsirt.org/vuln/fkie_cve-2026-15534 <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.</p> <p>The regex engine&#39;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.</p> <p>A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.</p> <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.</p> <p>The regex engine&#39;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.</p> <p>A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-15534 https://cve.radiocsirt.org/vuln/ghsa-2cxw-qmfc-3vx3 <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.</p> <p>The regex engine&#39;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.</p> <p>A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.</p> <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.</p> <p>The regex engine&#39;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.</p> <p>A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.</p> https://cve.radiocsirt.org/vuln/ghsa-2cxw-qmfc-3vx3 https://cve.radiocsirt.org/vuln/msrc_cve-2026-15534 msrc_CVE-2026-15534 https://cve.radiocsirt.org/vuln/msrc_cve-2026-15534 https://cve.radiocsirt.org/vuln/oesa-2026-3425 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: perl, openEuler:20.03-LTS-SP4: perl, openEuler:22.03-LTS-SP4: perl, openEuler:24.03-LTS-SP1: perl, openEuler:24.03-LTS-SP3: perl</p> <p>Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fix(es):</p> <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.</p> <p>The regex engine&amp;apos;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.</p> <p>A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.(CVE-2026-15534)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: perl, openEuler:20.03-LTS-SP4: perl, openEuler:22.03-LTS-SP4: perl, openEuler:24.03-LTS-SP1: perl, openEuler:24.03-LTS-SP3: perl</p> <p>Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fix(es):</p> <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.</p> <p>The regex engine&amp;apos;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.</p> <p>A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.(CVE-2026-15534)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3425 https://cve.radiocsirt.org/vuln/rhsa-2026:63403 <p>perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine.</p> <p>perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine.</p> https://cve.radiocsirt.org/vuln/rhsa-2026:63403 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-15534 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:26.04:LTS: perl</p> <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine&#39;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:26.04:LTS: perl</p> <p>Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine&#39;s superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-15534 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2717 <p>Ein Angreifer kann eine Schwachstelle in Perl ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein Angreifer kann eine Schwachstelle in Perl ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2717