Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

CVE-2026-15534 is a vulnerability in the Perl regular expression engine within Red Hat Hardened Images. It arises from a signed 32-bit integer overflow in the calculation of the superlinear cache size during regex matching, leading to out-of-bounds heap memory reads and writes. Exploitation requires processing a very large input (~273 MiB) against a complex regex pattern involving at least 15 WHILEM nodes. The vulnerability primarily causes denial of service through process crashes; there is no evidence of arbitrary code execution. Red Hat has chosen to defer an official fix due to the high complexity of the issue and its limited exposure. Recommended mitigations are to limit the size of untrusted inputs and avoid complex regex patterns on untrusted data.

The vulnerability can cause denial of service by crashing processes that perform regex matching on specially crafted large inputs. There is no confirmed exploitation leading to arbitrary code execution. The risk is limited by the requirement for very large input sizes and complex regex patterns.

Red Hat has deferred an official fix for this vulnerability. Mitigations include limiting the size of untrusted input to avoid processing very large data (~273 MiB) and avoiding the use of complex regular expressions with many WHILEM nodes on untrusted data. Users should apply these mitigations to reduce exposure. Patch status is not yet confirmed — check the Red Hat advisory for current remediation guidance.