{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nperl:\n  * perl-5.42.2-525.1.hum1 (aarch64, x86_64)\n  * perl-Attribute-Handlers-1.03-525.1.hum1 (noarch)\n  * perl-AutoLoader-5.74-525.1.hum1 (noarch)\n  * perl-AutoSplit-5.74-525.1.hum1 (noarch)\n  * perl-B-1.89-525.1.hum1 (aarch64, x86_64)\n  * perl-Benchmark-1.27-525.1.hum1 (noarch)\n  * perl-Class-Struct-0.68-525.1.hum1 (noarch)\n  * perl-Config-Extensions-0.03-525.1.hum1 (noarch)\n  * perl-DBM_Filter-0.07-525.1.hum1 (noarch)\n  * perl-Devel-Peek-1.36-525.1.hum1 (aarch64, x86_64)\n  * perl-Devel-SelfStubber-1.06-525.1.hum1 (noarch)\n  * perl-DirHandle-1.05-525.1.hum1 (noarch)\n  * perl-Dumpvalue-2.27-525.1.hum1 (noarch)\n  * perl-DynaLoader-1.57-525.1.hum1 (aarch64, x86_64)\n  * perl-English-1.11-525.1.hum1 (noarch)\n  * perl-Errno-1.38-525.1.hum1 (aarch64, x86_64)\n  * perl-ExtUtils-Constant-0.25-525.1.hum1 (noarch)\n  * perl-ExtUtils-Embed-1.35-525.1.hum1 (noarch)\n  * perl-ExtUtils-Miniperl-1.14-525.1.hum1 (noarch)\n  * perl-Fcntl-1.20-525.1.hum1 (aarch64, x86_64)\n  * perl-File-Basename-2.86-525.1.hum1 (noarch)\n  * perl-File-Compare-1.100.800-525.1.hum1 (noarch)\n  * perl-File-Copy-2.41-525.1.hum1 (noarch)\n  * perl-File-DosGlob-1.12-525.1.hum1 (aarch64, x86_64)\n  * perl-File-Find-1.44-525.1.hum1 (noarch)\n  * perl-File-stat-1.14-525.1.hum1 (noarch)\n  * perl-FileCache-1.10-525.1.hum1 (noarch)\n  * perl-FileHandle-2.05-525.1.hum1 (noarch)\n  * perl-FindBin-1.54-525.1.hum1 (noarch)\n  * perl-GDBM_File-1.24-525.1.hum1 (aarch64, x86_64)\n  * perl-Getopt-Std-1.14-525.1.hum1 (noarch)\n  * perl-Hash-Util-0.32-525.1.hum1 (aarch64, x86_64)\n  * perl-Hash-Util-FieldHash-1.27-525.1.hum1 (aarch64, x86_64)\n  * perl-I18N-Collate-1.02-525.1.hum1 (noarch)\n  * perl-I18N-LangTags-0.45-525.1.hum1 (noarch)\n  * perl-I18N-Langinfo-0.24-525.1.hum1 (aarch64, x86_64)\n  * perl-IO-1.55-525.1.hum1 (aarch64, x86_64)\n  * perl-IPC-Open3-1.24-525.1.hum1 (noarch)\n  * perl-Locale-Maketext-Simple-0.21-525.1.hum1 (noarch)\n  * perl-Math-Complex-1.63-525.1.hum1 (noarch)\n  * perl-Memoize-1.17-525.1.hum1 (noarch)\n  * perl-Module-Loaded-0.08-525.1.hum1 (noarch)\n  * perl-NDBM_File-1.18-525.1.hum1 (aarch64, x86_64)\n  * perl-NEXT-0.69-525.1.hum1 (noarch)\n  * perl-Net-1.04-525.1.hum1 (noarch)\n  * perl-ODBM_File-1.20-525.1.hum1 (aarch64, x86_64)\n  * perl-Opcode-1.69-525.1.hum1 (aarch64, x86_64)\n  * perl-POSIX-2.23-525.1.hum1 (aarch64, x86_64)\n  * perl-Pod-Functions-1.14-525.1.hum1 (noarch)\n  * perl-Pod-Html-1.35-525.1.hum1 (noarch)\n  * perl-Safe-2.47-525.1.hum1 (noarch)\n  * perl-Search-Dict-1.08-525.1.hum1 (noarch)\n  * perl-SelectSaver-1.02-525.1.hum1 (noarch)\n  * perl-SelfLoader-1.28-525.1.hum1 (noarch)\n  * perl-Symbol-1.09-525.1.hum1 (noarch)\n  * perl-Sys-Hostname-1.25-525.1.hum1 (aarch64, x86_64)\n  * perl-Term-Complete-1.403-525.1.hum1 (noarch)\n  * perl-Term-ReadLine-1.17-525.1.hum1 (noarch)\n  * perl-Test-1.31-525.1.hum1 (noarch)\n  * perl-Text-Abbrev-1.02-525.1.hum1 (noarch)\n  * perl-Thread-3.06-525.1.hum1 (noarch)\n  * perl-Thread-Semaphore-2.13-525.1.hum1 (noarch)\n  * perl-Tie-4.6-525.1.hum1 (noarch)\n  * perl-Tie-File-1.10-525.1.hum1 (noarch)\n  * perl-Tie-Memoize-1.1-525.1.hum1 (noarch)\n  * perl-Time-1.04-525.1.hum1 (noarch)\n  * perl-Time-Piece-1.3600-525.1.hum1 (aarch64, x86_64)\n  * perl-Unicode-UCD-0.81-525.1.hum1 (noarch)\n  * perl-User-pwent-1.05-525.1.hum1 (noarch)\n  * perl-autouse-1.11-525.1.hum1 (noarch)\n  * perl-base-2.27-525.1.hum1 (noarch)\n  * perl-blib-1.07-525.1.hum1 (noarch)\n  * perl-debugger-1.60-525.1.hum1 (noarch)\n  * perl-deprecate-0.04-525.1.hum1 (noarch)\n  * perl-devel-5.42.2-525.1.hum1 (aarch64, x86_64)\n  * perl-diagnostics-1.40-525.1.hum1 (noarch)\n  * perl-doc-5.42.2-525.1.hum1 (noarch)\n  * perl-encoding-warnings-0.14-525.1.hum1 (noarch)\n  * perl-fields-2.27-525.1.hum1 (noarch)\n  * perl-filetest-1.03-525.1.hum1 (noarch)\n  * perl-if-0.61.000-525.1.hum1 (noarch)\n  * perl-interpreter-5.42.2-525.1.hum1 (aarch64, x86_64)\n  * perl-less-0.03-525.1.hum1 (noarch)\n  * perl-lib-0.65-525.1.hum1 (aarch64, x86_64)\n  * perl-libnetcfg-5.42.2-525.1.hum1 (noarch)\n  * perl-libs-5.42.2-525.1.hum1 (aarch64, x86_64)\n  * perl-locale-1.13-525.1.hum1 (noarch)\n  * perl-macros-5.42.2-525.1.hum1 (noarch)\n  * perl-meta-notation-5.42.2-525.1.hum1 (noarch)\n  * perl-mro-1.29-525.1.hum1 (aarch64, x86_64)\n  * perl-open-1.13-525.1.hum1 (noarch)\n  * perl-overload-1.40-525.1.hum1 (noarch)\n  * perl-overloading-0.02-525.1.hum1 (noarch)\n  * perl-ph-5.42.2-525.1.hum1 (aarch64, x86_64)\n  * perl-sigtrap-1.10-525.1.hum1 (noarch)\n  * perl-sort-2.06-525.1.hum1 (noarch)\n  * perl-subs-1.04-525.1.hum1 (noarch)\n  * perl-tests-5.42.2-525.1.hum1 (aarch64, x86_64)\n  * perl-utils-5.42.2-525.1.hum1 (noarch)\n  * perl-vars-1.05-525.1.hum1 (noarch)\n  * perl-vmsish-1.04-525.1.hum1 (noarch)\n  * perl-5.42.2-525.1.hum1.src (src)\n\nSecurity Fix(es):\n\nperl:\n  * CVE-2026-15534",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:63403",
        "url": "https://access.redhat.com/errata/RHSA-2026:63403"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-15534",
        "url": "https://access.redhat.com/security/cve/CVE-2026-15534"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63403.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update",
    "tracking": {
      "current_release_date": "2026-09-04T18:34:04+00:00",
      "generator": {
        "date": "2026-09-04T18:34:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:63403",
      "initial_release_date": "2026-09-03T22:59:18+00:00",
      "revision_history": [
        {
          "date": "2026-09-03T22:59:18+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-04T00:36:24+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-04T18:34:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-main@aarch64",
                "product": {
                  "name": "perl-main@aarch64",
                  "product_id": "perl-main@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl@5.42.2-525.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-main@src",
                "product": {
                  "name": "perl-main@src",
                  "product_id": "perl-main@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl@5.42.2-525.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-main@x86_64",
                "product": {
                  "name": "perl-main@x86_64",
                  "product_id": "perl-main@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl@5.42.2-525.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-main@noarch",
                "product": {
                  "name": "perl-main@noarch",
                  "product_id": "perl-main@noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-Attribute-Handlers@1.03-525.1.hum1?arch=noarch\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-main@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:perl-main@aarch64"
        },
        "product_reference": "perl-main@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-main@noarch as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:perl-main@noarch"
        },
        "product_reference": "perl-main@noarch",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-main@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:perl-main@src"
        },
        "product_reference": "perl-main@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-main@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:perl-main@x86_64"
        },
        "product_reference": "perl-main@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-15534",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-08-09T18:00:58.672246+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512950"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine\u0027s superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression matching. This could result in a denial of service (DoS) due to a process crash or potentially lead to heap memory corruption, enabling arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw has a Moderate impact. Perl\u0027s regular expression engine contains a signed 32-bit integer overflow in the superlinear-cache size calculation (S_regmatch) that can cause out-of-bounds heap reads and writes during regex matching. Triggering it requires an application to match an attacker-controlled subject of roughly 273 MiB against a pattern containing at least 15 participating WHILEM nodes, so attack complexity is high. Successful exploitation most likely results in a process crash (denial of service); the out-of-bounds access is bit-granular into a cache bitmap, so controlled memory corruption or arbitrary code execution has not been demonstrated. Given the large, unusual inputs required and the limited reachability of the vulnerable path, Red Hat has deferred fixing this issue; residual risk is limited to a potential denial of service in applications matching very large untrusted inputs against complex patterns.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:perl-main@aarch64",
          "Red Hat Hardened Images:perl-main@noarch",
          "Red Hat Hardened Images:perl-main@src",
          "Red Hat Hardened Images:perl-main@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-15534"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512950",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512950"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-15534",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-15534"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15534",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15534"
        },
        {
          "category": "external",
          "summary": "https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch",
          "url": "https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch"
        },
        {
          "category": "external",
          "summary": "https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch",
          "url": "https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch"
        }
      ],
      "release_date": "2026-08-09T17:49:50.033000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-03T22:59:18+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:perl-main@aarch64",
            "Red Hat Hardened Images:perl-main@noarch",
            "Red Hat Hardened Images:perl-main@src",
            "Red Hat Hardened Images:perl-main@x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:63403"
        },
        {
          "category": "workaround",
          "details": "Applications can reduce exposure by limiting the size of untrusted input passed to regular-expression matching (the overflow requires a subject on the order of 273 MiB) and by avoiding matching untrusted data against highly complex patterns.",
          "product_ids": [
            "Red Hat Hardened Images:perl-main@aarch64",
            "Red Hat Hardened Images:perl-main@noarch",
            "Red Hat Hardened Images:perl-main@src",
            "Red Hat Hardened Images:perl-main@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:perl-main@aarch64",
            "Red Hat Hardened Images:perl-main@noarch",
            "Red Hat Hardened Images:perl-main@src",
            "Red Hat Hardened Images:perl-main@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine."
    }
  ]
}