QSN-8736-1: Perl vulnerabilities
2026-09-08

Summary:
Several security issues were fixed in Perl.

Details:
It was discovered that Perl incorrectly handled certain large inputs during
regular expression matching. An attacker could possibly use this issue to
trigger out-of-bounds heap reads or writes, resulting in a denial of
service or arbitrary code execution. (CVE-2026-15534)

It was discovered that Perl incorrectly handled certain regular expression
containing alternative matching branches. An attacker could  possibly use
this issue to cause incorrect regular expression matches, resulting in
security restrictions being bypassed. (CVE-2026-19487)

Affected QuantaStor releases:
  6.9.1.001 jammy: libperl5.34 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.9.1.001 jammy: perl 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.9.1.001 jammy: perl-base 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.9.1.001 jammy: perl-modules-5.34 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.9.0.464 jammy: libperl5.34 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.9.0.464 jammy: perl 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.9.0.464 jammy: perl-base 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.9.0.464 jammy: perl-modules-5.34 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.8.6.015 jammy: libperl5.34 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.8.6.015 jammy: perl 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.8.6.015 jammy: perl-base 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.8.6.015 jammy: perl-modules-5.34 5.34.0-3ubuntu1.9 (fixed in 5.34.0-3ubuntu1.9)
  6.8.5.018 jammy: libperl5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.5.018 jammy: perl 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.5.018 jammy: perl-base 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.5.018 jammy: perl-modules-5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.4.038 jammy: libperl5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.4.038 jammy: perl 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.4.038 jammy: perl-base 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.4.038 jammy: perl-modules-5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.3.018 jammy: libperl5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.3.018 jammy: perl 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.3.018 jammy: perl-base 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.3.018 jammy: perl-modules-5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.2.002 jammy: libperl5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.2.002 jammy: perl 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.2.002 jammy: perl-base 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.2.002 jammy: perl-modules-5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.1.007 jammy: libperl5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.1.007 jammy: perl 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.1.007 jammy: perl-base 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.1.007 jammy: perl-modules-5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.0.205 jammy: libperl5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.0.205 jammy: perl 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.0.205 jammy: perl-base 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)
  6.8.0.205 jammy: perl-modules-5.34 5.34.0-3ubuntu1.7 (fixed in 5.34.0-3ubuntu1.9)

CVEs: CVE-2026-19487, CVE-2026-15534

References:
  https://ubuntu.com/security/notices/USN-8736-1