/ 
perl-5.27.2
⭐ Starred 2013 / perl5203delta
Security Advisories (13)
CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2026-57432 (2026-07-13)

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2026-13221 (2026-07-13)

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2026-19487 (2026-08-13)

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

CVE-2018-6798 (2018-04-17)

An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

NAME

perl5203delta - what is new for perl v5.20.3

DESCRIPTION

This document describes differences between the 5.20.2 release and the 5.20.3 release.

If you are upgrading from an earlier release such as 5.20.1, first read perl5202delta, which describes differences between 5.20.1 and 5.20.2.

Incompatible Changes

There are no changes intentionally incompatible with 5.20.2. If any exist, they are bugs, and we request that you submit a report. See "Reporting Bugs" below.

Modules and Pragmata

Updated Modules and Pragmata

  • Errno has been upgraded from version 1.20_05 to 1.20_06.

    Add -P to the pre-processor command-line on GCC 5. GCC added extra line directives, breaking parsing of error code definitions. [perl #123784]

  • Module::CoreList has been upgraded from version 5.20150214 to 5.20150822.

    Updated to cover the latest releases of Perl.

  • perl5db.pl has been upgraded from 1.44 to 1.44_01.

    The debugger would cause an assertion failure. [perl #124127]

Documentation

Changes to Existing Documentation

perlfunc

  • Mention that study() is currently a no-op.

perlguts

  • The OOK example has been updated to account for COW changes and a change in the storage of the offset.

perlhacktips

  • Documentation has been added illustrating the perils of assuming the contents of static memory pointed to by the return values of Perl wrappers for C library functions doesn't change.

perlpodspec

  • The specification of the POD language is changing so that the default encoding of PODs that aren't in UTF-8 (unless otherwise indicated) is CP1252 instead of ISO-8859-1 (Latin1).

Utility Changes

h2ph

  • h2ph now handles hexadecimal constants in the compiler's predefined macro definitions, as visible in $Config{cppsymbols}. [perl #123784]

Testing

  • t/perf/taint.t has been added to see if optimisations with taint issues are keeping things fast.

  • t/porting/re_context.t has been added to test that utf8 and its dependencies only use the subset of the $1..$n capture vars that Perl_save_re_context() is hard-coded to localize, because that function has no efficient way of determining at runtime what vars to localize.

Platform Support

Platform-Specific Notes

Win32

  • Previously, when compiling with a 64-bit Visual C++, every Perl XS module (including CPAN ones) and Perl aware C file would unconditionally have around a dozen warnings from hv_func.h. These warnings have been silenced. GCC (all bitness) and 32-bit Visual C++ were not affected.

  • miniperl.exe is now built with -fno-strict-aliasing, allowing 64-bit builds to complete with GCC 4.8. [perl #123976]

Selected Bug Fixes

  • Repeated global pattern matches in scalar context on large tainted strings were exponentially slow depending on the current match position in the string. [perl #123202]

  • The original visible value of $/ is now preserved when it is set to an invalid value. Previously if you set $/ to a reference to an array, for example, perl would produce a runtime error and not set PL_rs, but Perl code that checked $/ would see the array reference. [perl #123218]

  • Perl 5.14.0 introduced a bug whereby eval { LABEL: } would crash. This has been fixed. [perl #123652]

  • Extending an array cloned from a parent thread could result in "Modification of a read-only value attempted" errors when attempting to modify the new elements. [perl #124127]

  • Several cases of data used to store environment variable contents in core C code being potentially overwritten before being used have been fixed. [perl #123748]

  • UTF-8 variable names used in array indexes, unquoted UTF-8 HERE-document terminators and UTF-8 function names all now work correctly. [perl #124113]

  • A subtle bug introduced in Perl 5.20.2 involving UTF-8 in regular expressions and sometimes causing a crash has been fixed. A new test script has been added to test this fix; see under "Testing". [perl #124109]

  • Some patterns starting with /.*..../ matched against long strings have been slow since Perl 5.8, and some of the form /.*..../i have been slow since Perl 5.18. They are now all fast again. [perl #123743]

  • Warning fatality is now ignored when rewinding the stack. This prevents infinite recursion when the now fatal error also causes rewinding of the stack. [perl #123398]

  • setpgrp($nonzero) (with one argument) was accidentally changed in Perl 5.16 to mean setpgrp(0). This has been fixed.

  • A crash with %::=(); J->${\"::"} has been fixed. [perl #125541]

  • Regular expression possessive quantifier Perl 5.20 regression now fixed. qr/PAT{min,max}+/ is supposed to behave identically to qr/(?>PAT{min,max})/. Since Perl 5.20, this didn't work if min and max were equal. [perl #125825]

  • Code like /$a[/ used to read the next line of input and treat it as though it came immediately after the opening bracket. Some invalid code consequently would parse and run, but some code caused crashes, so this is now disallowed. [perl #123712]

Acknowledgements

Perl 5.20.3 represents approximately 7 months of development since Perl 5.20.2 and contains approximately 3,200 lines of changes across 99 files from 26 authors.

Excluding auto-generated files, documentation and release tools, there were approximately 1,500 lines of changes to 43 .pm, .t, .c and .h files.

Perl continues to flourish into its third decade thanks to a vibrant community of users and developers. The following people are known to have contributed the improvements that became Perl 5.20.3:

Alex Vandiver, Andy Dougherty, Aristotle Pagaltzis, Chris 'BinGOs' Williams, Craig A. Berry, Dagfinn Ilmari Mannsåker, Daniel Dragan, David Mitchell, Father Chrysostomos, H.Merijn Brand, James E Keenan, James McCoy, Jarkko Hietaniemi, Karen Etheridge, Karl Williamson, kmx, Lajos Veres, Lukas Mai, Matthew Horsfall, Petr Písař, Randy Stauner, Ricardo Signes, Sawyer X, Steve Hay, Tony Cook, Yves Orton.

The list above is almost certainly incomplete as it is automatically generated from version control history. In particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker.

Many of the changes included in this version originated in the CPAN modules included in Perl's core. We're grateful to the entire CPAN community for helping Perl to flourish.

For a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.

Reporting Bugs

If you find what you think is a bug, you might check the articles recently posted to the comp.lang.perl.misc newsgroup and the perl bug database at https://rt.perl.org/ . There may also be information at http://www.perl.org/ , the Perl Home Page.

If you believe you have an unreported bug, please run the perlbug program included with your release. Be sure to trim your bug down to a tiny but sufficient test case. Your bug report, along with the output of perl -V, will be sent off to perlbug@perl.org to be analysed by the Perl porting team.

If the bug you are reporting has security implications, which make it inappropriate to send to a publicly archived mailing list, then please send it to perl5-security-report@perl.org. This points to a closed subscription unarchived mailing list, which includes all the core committers, who will be able to help assess the impact of issues, figure out a resolution, and help co-ordinate the release of patches to mitigate or fix the problem across all platforms on which Perl is supported. Please only use this address for security issues in the Perl core, not for modules independently distributed on CPAN.

SEE ALSO

The Changes file for an explanation of how to view exhaustive details on what changed.

The INSTALL file for how to build Perl.

The README file for general stuff.

The Artistic and Copying files for copyright information.