CVE-2026-15534ModerateRevised 10 Sep

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch

MSRC advisory NVD CVE.org

Assessment

Severity: Moderate
CVSS base score: 5.7CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Impact: Not stated
EPSS, next 30 days: Not scored yet
Public exploit code: No Nuclei template lists it
Exploitability: Not assessed
Publicly disclosed: No
Customer action: Required: apply the update
Component: Mariner
Weakness: CWE-190: Integer Overflow or Wraparound
Issued by: CPANSec
Published: 11 Aug 2026 · August 2026
Last revised: 10 Sep 2026Information published.

Updates that fix it

0 KBs

No KB listed

MSRC lists no downloadable update, which usually means a service-side fix or a release-notes update. Check the MSRC advisory.

Affected products

2 affected products

azl3 perl 5.38.2-514 on Azure Linux 3.0
azl3 perl 5.38.2-516 on Azure Linux 3.0

What changed

First observed 14 Oct 2026

14 Oct 2026 Source coverage: msrc-cvrfIncomplete → Current

The most recent 100 field changes are listed. Complete recorded revisions are kept separately.

Cite this recorded revision to keep the same title, summary, facts and links when the page changes.

A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.