CVE-2026-15534: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-15534 is a heap memory corruption vulnerability in Perl's regular expression engine affecting all versions through 5.45.1. The flaw involves out-of-bounds heap reads and writes caused by an integer overflow in the superlinear cache (SLC) size calculation within S_regmatch. It was published on August 9, 2026, assigned by CPANSec, and a patch is available. The CVSS score has not yet been formally assigned, though it is estimated as Medium severity (GitHub Advisory, Feedly).

The root cause is an integer overflow (CWE-190) in the Perl regex engine's superlinear cache initialization, leading to out-of-bounds reads (CWE-125) and writes (CWE-787). The SLC stores one bit per subject position per participating WHILEM node; the bit count is computed as (subject_length + 1) * num_nodes, stored in a signed 32-bit integer (I32). With a subject of approximately 286,331,153 bytes and 15 WHILEM nodes, this product overflows and is stored as 14, resulting in only a 2-byte cache allocation. Subsequent cache indexing using the real match position and node number reads past the allocation boundary, and on match failure, CACHEsayNO writes a bit beyond the allocated buffer. The fix, authored by David Mitchell, changes the counter types to STRLEN (typically 64-bit unsigned) and adds an overflow guard that disables the cache if the calculation would overflow (Perl5 Commit 1, Perl5 Commit 2).

Successful exploitation can cause a process crash (denial of service) or heap memory corruption, which may enable arbitrary code execution in the context of the Perl process. An attacker who can control the subject string passed to a Perl regex operation — for example, via a web application, data processing pipeline, or any Perl script that matches user-supplied input — can trigger this condition. The potential for heap corruption elevates the risk beyond a simple crash, as it may allow an attacker to achieve remote code execution depending on the application context (GitHub Advisory, Feedly).

As of the disclosure date (August 9, 2026), there is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to supply an attacker-controlled subject string of approximately 286 MB to a Perl regex operation involving a pattern with 15 or more participating WHILEM nodes, which is a non-trivial precondition (GitHub Advisory, Feedly).

1. Identify a target: Find a Perl application (e.g., a web service, data processing script, or CGI handler) that accepts attacker-controlled input and passes it as the subject string to a regular expression match operation.
2. Identify a vulnerable regex pattern: Determine or influence a regex pattern in the target application that contains 15 or more participating WHILEM nodes (e.g., deeply nested quantifiers like ((aaa)+)+ repeated sufficiently).
3. Craft the payload: Construct a subject string of approximately 286,331,153 bytes (≈273 MB) designed to trigger the integer overflow in the superlinear cache size calculation.
4. Trigger the overflow: Submit the crafted subject string to the target application so it is matched against the vulnerable pattern, causing poscache_maxiter to overflow to 14 and allocating only a 2-byte cache.
5. Achieve heap corruption: The regex engine indexes the undersized cache using real match positions, causing out-of-bounds reads and writes; on failure, CACHEsayNO writes a bit beyond the allocation, corrupting adjacent heap memory.
6. Escalate: Depending on heap layout and application context, leverage the heap corruption to achieve process crash (DoS) or, with further exploitation primitives, arbitrary code execution (GitHub Advisory, Perl5 Commit 1).

• Process Behavior: Perl processes crashing unexpectedly or producing segmentation faults when processing large input strings; abnormal memory usage spikes (approaching or exceeding 273 MB) in Perl processes.
• Logs: Application error logs showing Perl process crashes, core dumps, or Segmentation fault messages correlated with regex operations on large inputs; system logs (/var/log/syslog, /var/log/messages) recording abnormal Perl process terminations.
• Network: Unusually large HTTP request bodies (approaching 286 MB) submitted to Perl-based web endpoints; repeated large payloads from a single source IP targeting the same endpoint.
• File System: Core dump files (e.g., core.*) generated in the working directory of a Perl application, indicating process crashes during regex matching.

Upgrade Perl to a version after 5.45.1 that includes the two-commit fix by David Mitchell: the first commit (568e6fd) makes the SLC countdown unsigned, and the second commit (54cf3d4) changes poscache_maxiter and poscache_iter from I32 to STRLEN (64-bit unsigned) and adds an overflow guard that disables the cache if the size calculation would overflow. As a workaround prior to patching, implement input validation to reject or truncate subject strings exceeding a safe size threshold (well below 286 MB) before they are passed to regex operations. Additionally, consider running Perl applications in sandboxed or resource-limited environments (e.g., using ulimit to cap memory) to reduce the impact of potential heap corruption (Perl5 Commit 1, Perl5 Commit 2, GitHub Advisory).