USN-8736-2

It was discovered that Perl incorrectly handled certain large inputs during regular expression matching. An attacker could possibly use this issue to trigger out-of-bounds heap reads or writes, resulting in a denial of service or arbitrary code execution. (CVE-2026-15534)

It was discovered that Perl incorrectly handled certain regular expression containing alternative matching branches. An attacker could possibly use this issue to cause incorrect regular expression matches, resulting in security restrictions being bypassed. (CVE-2026-19487)

References

Affected packages

Ubuntu:24.04:LTS / perl

Package

Name: perl
Purl: pkg:deb/ubuntu/perl?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.38.2-3.2ubuntu0.6

Affected versions

5.*

5.36.0-9ubuntu1

5.36.0-10ubuntu1

5.38.2-3

5.38.2-3.2

5.38.2-3.2build1

5.38.2-3.2build2

5.38.2-3.2build2.1

5.38.2-3.2ubuntu0.1

5.38.2-3.2ubuntu0.2

5.38.2-3.2ubuntu0.3

5.38.2-3.2ubuntu0.4

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libperl5.38t64",
            "binary_version": "5.38.2-3.2ubuntu0.6"
        },
        {
            "binary_name": "perl",
            "binary_version": "5.38.2-3.2ubuntu0.6"
        },
        {
            "binary_name": "perl-base",
            "binary_version": "5.38.2-3.2ubuntu0.6"
        },
        {
            "binary_name": "perl-debug",
            "binary_version": "5.38.2-3.2ubuntu0.6"
        },
        {
            "binary_name": "perl-modules-5.38",
            "binary_version": "5.38.2-3.2ubuntu0.6"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2026-15534",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        },
        {
            "id": "CVE-2026-19487",
            "severity": [
                {
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                    "type": "CVSS_V3"
                },
                {
                    "score": "medium",
                    "type": "Ubuntu"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8736-2.json"