OESA-2026-3425

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3425
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3425.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3425
Upstream
Published
2026-08-20T09:57:16Z
Modified
2026-08-20T10:15:08.935656593Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
perl security update
Details

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.

A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.(CVE-2026-15534)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4
perl

Package

Name
perl
Purl
pkg:rpm/openEuler/perl&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.28.3-15.oe2003sp4

Ecosystem specific 

{
    "src": [
        "perl-5.28.3-15.oe2003sp4.src.rpm"
    ],
    "x86_64": [
        "perl-5.28.3-15.oe2003sp4.x86_64.rpm",
        "perl-debuginfo-5.28.3-15.oe2003sp4.x86_64.rpm",
        "perl-debugsource-5.28.3-15.oe2003sp4.x86_64.rpm",
        "perl-devel-5.28.3-15.oe2003sp4.x86_64.rpm",
        "perl-libs-5.28.3-15.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "perl-5.28.3-15.oe2003sp4.aarch64.rpm",
        "perl-debuginfo-5.28.3-15.oe2003sp4.aarch64.rpm",
        "perl-debugsource-5.28.3-15.oe2003sp4.aarch64.rpm",
        "perl-devel-5.28.3-15.oe2003sp4.aarch64.rpm",
        "perl-libs-5.28.3-15.oe2003sp4.aarch64.rpm"
    ],
    "noarch": [
        "perl-help-5.28.3-15.oe2003sp4.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3425.json"
openEuler:22.03-LTS-SP4
perl

Package

Name
perl
Purl
pkg:rpm/openEuler/perl&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.34.0-18.oe2203sp4

Ecosystem specific 

{
    "src": [
        "perl-5.34.0-18.oe2203sp4.src.rpm"
    ],
    "x86_64": [
        "perl-5.34.0-18.oe2203sp4.x86_64.rpm",
        "perl-debuginfo-5.34.0-18.oe2203sp4.x86_64.rpm",
        "perl-debugsource-5.34.0-18.oe2203sp4.x86_64.rpm",
        "perl-devel-5.34.0-18.oe2203sp4.x86_64.rpm",
        "perl-libs-5.34.0-18.oe2203sp4.x86_64.rpm"
    ],
    "aarch64": [
        "perl-5.34.0-18.oe2203sp4.aarch64.rpm",
        "perl-debuginfo-5.34.0-18.oe2203sp4.aarch64.rpm",
        "perl-debugsource-5.34.0-18.oe2203sp4.aarch64.rpm",
        "perl-devel-5.34.0-18.oe2203sp4.aarch64.rpm",
        "perl-libs-5.34.0-18.oe2203sp4.aarch64.rpm"
    ],
    "noarch": [
        "perl-help-5.34.0-18.oe2203sp4.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3425.json"
openEuler:24.03-LTS-SP1
perl

Package

Name
perl
Purl
pkg:rpm/openEuler/perl&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.38.0-17.oe2403sp1

Ecosystem specific 

{
    "src": [
        "perl-5.38.0-17.oe2403sp1.src.rpm"
    ],
    "x86_64": [
        "perl-5.38.0-17.oe2403sp1.x86_64.rpm",
        "perl-debuginfo-5.38.0-17.oe2403sp1.x86_64.rpm",
        "perl-debugsource-5.38.0-17.oe2403sp1.x86_64.rpm",
        "perl-devel-5.38.0-17.oe2403sp1.x86_64.rpm",
        "perl-libs-5.38.0-17.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "perl-5.38.0-17.oe2403sp1.aarch64.rpm",
        "perl-debuginfo-5.38.0-17.oe2403sp1.aarch64.rpm",
        "perl-debugsource-5.38.0-17.oe2403sp1.aarch64.rpm",
        "perl-devel-5.38.0-17.oe2403sp1.aarch64.rpm",
        "perl-libs-5.38.0-17.oe2403sp1.aarch64.rpm"
    ],
    "noarch": [
        "perl-help-5.38.0-17.oe2403sp1.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3425.json"
openEuler:24.03-LTS-SP3
perl

Package

Name
perl
Purl
pkg:rpm/openEuler/perl&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.38.0-17.oe2403sp3

Ecosystem specific 

{
    "src": [
        "perl-5.38.0-17.oe2403sp3.src.rpm"
    ],
    "x86_64": [
        "perl-5.38.0-17.oe2403sp3.x86_64.rpm",
        "perl-debuginfo-5.38.0-17.oe2403sp3.x86_64.rpm",
        "perl-debugsource-5.38.0-17.oe2403sp3.x86_64.rpm",
        "perl-devel-5.38.0-17.oe2403sp3.x86_64.rpm",
        "perl-libs-5.38.0-17.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "perl-5.38.0-17.oe2403sp3.aarch64.rpm",
        "perl-debuginfo-5.38.0-17.oe2403sp3.aarch64.rpm",
        "perl-debugsource-5.38.0-17.oe2403sp3.aarch64.rpm",
        "perl-devel-5.38.0-17.oe2403sp3.aarch64.rpm",
        "perl-libs-5.38.0-17.oe2403sp3.aarch64.rpm"
    ],
    "noarch": [
        "perl-help-5.38.0-17.oe2403sp3.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3425.json"
openEuler:24.03-LTS-SP4
perl

Package

Name
perl
Purl
pkg:rpm/openEuler/perl&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.38.0-17.oe2403sp4

Ecosystem specific 

{
    "src": [
        "perl-5.38.0-17.oe2403sp4.src.rpm"
    ],
    "x86_64": [
        "perl-5.38.0-17.oe2403sp4.x86_64.rpm",
        "perl-debuginfo-5.38.0-17.oe2403sp4.x86_64.rpm",
        "perl-debugsource-5.38.0-17.oe2403sp4.x86_64.rpm",
        "perl-devel-5.38.0-17.oe2403sp4.x86_64.rpm",
        "perl-libs-5.38.0-17.oe2403sp4.x86_64.rpm"
    ],
    "aarch64": [
        "perl-5.38.0-17.oe2403sp4.aarch64.rpm",
        "perl-debuginfo-5.38.0-17.oe2403sp4.aarch64.rpm",
        "perl-debugsource-5.38.0-17.oe2403sp4.aarch64.rpm",
        "perl-devel-5.38.0-17.oe2403sp4.aarch64.rpm",
        "perl-libs-5.38.0-17.oe2403sp4.aarch64.rpm"
    ],
    "noarch": [
        "perl-help-5.38.0-17.oe2403sp4.noarch.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3425.json"