USN-8736-2: Perl vulnerabilities
Ubuntu issued USN-8736-2 fixing two Perl regex flaws that could cause out-of-bounds heap access, denial of service, or security bypass on 24.04 LTS.
USN-8736-2 backports the Perl fixes from USN-8736-1 to Ubuntu 24.04 LTS. CVE-2026-15534 involves out-of-bounds heap reads or writes when regular expressions handle large inputs, potentially causing denial of service or arbitrary code execution. CVE-2026-19487 causes incorrect regex matching with alternative branches, allowing security restrictions to be bypassed.
- CVE-2026-15534: out-of-bounds heap reads/writes via large regex input, possible code execution
- CVE-2026-19487: incorrect alternative-branch regex matching bypasses security restrictions
- Update applies the USN-8736-1 fixes to Ubuntu 24.04 LTS
- Products
- Perl
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15534 | Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch | 5.7 | <1% | ||
| CVE-2026-19487 | Perl regex engine flaw yields incorrect match results via stale failure flag | 5.3 | <1% |
From the original article
USN-8736-1 fixed vulnerabilities in Perl. This update provides the corresponding fix for Perl on Ubuntu 24. 04 LTS.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.