CVE-2026-15534: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-15534 is an integer overflow vulnerability in Perl's regular expression engine that leads to out-of-bounds heap reads and writes during regex matching via an undersized superlinear cache in S_regmatch. It affects all Perl versions through 5.45.1. The vulnerability was disclosed on August 9, 2026, by the CPAN Security Group (CPANSec) via the oss-security mailing list. It carries a CVSS v3.1 base score of 5.7 (Medium) (GitHub Advisory, oss-security).

The root cause is an integer overflow (CWE-190) in the calculation of the superlinear cache (SLC) size within S_regmatch in regexec.c. The SLC holds one bit per subject position per participating WHILEM node, and the total bit count is computed as (subject_length + 1) * num_nodes using a signed 32-bit integer (I32). With a subject of approximately 286,331,153 bytes and 15 WHILEM nodes, this product overflows the signed 32-bit type, wrapping to 14 — resulting in only a 2-byte cache allocation. Subsequent cache indexing using the real match position and node number then reads and writes beyond the allocated buffer (CWE-125, CWE-787). The fix, authored by David Mitchell, involves two commits: first changing the countdown logic to avoid negative values, then changing poscache_maxiter and poscache_iter from I32 to STRLEN (typically U64 on 64-bit systems) and adding an overflow guard that disables the cache if the calculation would overflow (Perl5 Commit 1, Perl5 Commit 2).

Successful exploitation can cause a process crash (denial of service) or heap memory corruption, with a theoretical path to arbitrary code execution in contexts where an attacker controls the regex subject string. The integrity impact is low (limited heap writes), while the availability impact is high due to the potential for process termination. Confidentiality is not directly impacted, but heap corruption could expose sensitive in-memory data or be leveraged for further exploitation in multi-tenant or server-side Perl applications (GitHub Advisory, oss-security).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure. The NVD SSVC assessment classifies exploitation as "none" and the attack as not automatable. The EPSS score is approximately 0.196% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to supply an attacker-controlled subject string of ~286 MB to a Perl regex operation using a pattern with 15 participating WHILEM nodes, which is a high-complexity precondition (GitHub Advisory, oss-security).

1. Identify a target: Find a Perl application (web service, script, or daemon) that accepts attacker-controlled input and passes it as the subject string to a regex match operation involving a pattern with 15 or more participating WHILEM nodes (e.g., deeply nested quantifiers like ((a+)+)+).
2. Craft the malicious subject string: Prepare a subject string of approximately 286,331,153 bytes (~273 MB). This specific size, when multiplied by 15 WHILEM nodes, causes the signed 32-bit cache size counter to overflow to 14, resulting in a 2-byte cache allocation.
3. Trigger the regex match: Submit the crafted subject string to the target application so it is matched against the vulnerable pattern. This can be via HTTP request body, file upload, form field, or any other input vector accepted by the application.
4. Achieve heap corruption or crash: The undersized cache is indexed using the real match position and node number, causing out-of-bounds reads and writes on the heap. On match failure, CACHEsayNO writes a bit past the end of the allocation, corrupting adjacent heap memory or crashing the process (oss-security, GitHub Advisory).

• Process Behavior: Perl interpreter process crashes (segmentation fault or abort) when processing large input strings; unexpected process termination in web servers or daemons running Perl.
• Logs: Application error logs showing Perl runtime crashes or core dumps; system logs (/var/log/syslog, dmesg) recording segfaults from Perl processes.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory of Perl applications, potentially containing heap memory artifacts.
• Network: Unusually large HTTP request bodies (~273 MB+) directed at Perl-based web endpoints; repeated large requests from the same source IP targeting the same endpoint.

The primary remediation is to upgrade Perl to a version after 5.45.1 that includes the two upstream patches by David Mitchell (commits 568e6fd and 54cf3d4). These patches change the poscache_maxiter and poscache_iter variables from signed 32-bit (I32) to STRLEN (unsigned 64-bit on most platforms) and add an overflow guard that disables the superlinear cache if the size calculation would overflow. As a workaround where upgrading is not immediately possible, implement input validation to reject or truncate regex subject strings exceeding a safe size threshold (well below 286 MB), and consider sandboxing Perl regex processing to limit the blast radius of potential heap corruption (Perl5 Commit 1, Perl5 Commit 2, oss-security).

The vulnerability was responsibly disclosed by Stig Palmquist of the CPAN Security Group (CPANSec) to the oss-security mailing list on August 9, 2026, with a follow-up clarification from Sevan Janiyan confirming that "through 5.45.1" means up to and including that version. The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. Community reaction has been measured given the high exploitation complexity and lack of a public PoC (oss-security, oss-security reply).