/ 
perl-5.42.0
⭐ Starred 2013 / CPAN::Meta::History
Security Advisories (5)
CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2026-57432 (2026-07-13)

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2026-8376 (2026-05-25)

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

CVE-2026-13221 (2026-07-13)

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

NAME

CPAN::Meta::History - history of CPAN Meta Spec changes

VERSION

version 2.150010

DESCRIPTION

The CPAN Meta Spec has gone through several iterations. It was originally written in HTML and later revised into POD (though published in HTML generated from the POD). Fields were added, removed or changed, sometimes by design and sometimes to reflect real-world usage after the fact.

This document reconstructs the history of the CPAN Meta Spec based on change logs, repository commit messages and the published HTML files. In some cases, particularly prior to version 1.2, the exact version when certain fields were introduced or changed is inconsistent between sources. When in doubt, the published HTML files for versions 1.0 to 1.4 as they existed when version 2 was developed are used as the definitive source.

Starting with version 2, the specification document is part of the CPAN-Meta distribution and will be published on CPAN as CPAN::Meta::Spec.

Going forward, specification version numbers will be integers and decimal portions will correspond to a release date for the CPAN::Meta library.

HISTORY

Version 2

April 2010

  • Revised spec examples as perl data structures rather than YAML

  • Switched to JSON serialization from YAML

  • Specified allowed version number formats

  • Replaced 'requires', 'build_requires', 'configure_requires', 'recommends' and 'conflicts' with new 'prereqs' data structure divided by phase (configure, build, test, runtime, etc.) and relationship (requires, recommends, suggests, conflicts)

  • Added support for 'develop' phase for requirements for maintaining a list of authoring tools

  • Changed 'license' to a list and revised the set of valid licenses

  • Made 'dynamic_config' mandatory to reduce confusion

  • Changed 'resources' subkey 'repository' to a hash that clarifies repository type, url for browsing and url for checkout

  • Changed 'resources' subkey 'bugtracker' to a hash for either web or mailto resource

  • Changed specification of 'optional_features':

    • Added formal specification and usage guide instead of just example

    • Changed to use new prereqs data structure instead of individual keys

  • Clarified intended use of 'author' as generalized contact list

  • Added 'release_status' field to indicate stable, testing or unstable status to provide hints to indexers

  • Added 'description' field for a longer description of the distribution

  • Formalized use of "x_" or "X_" for all custom keys not listed in the official spec

Version 1.4

June 2008

  • Noted explicit support for 'perl' in prerequisites

  • Added 'configure_requires' prerequisite type

  • Changed 'optional_features'

    • Example corrected to show map of maps instead of list of maps (though descriptive text said 'map' even in v1.3)

    • Removed 'requires_packages', 'requires_os' and 'excluded_os' as valid subkeys

Version 1.3

November 2006

  • Added 'no_index' subkey 'directory' and removed 'dir' to match actual usage in the wild

  • Added a 'repository' subkey to 'resources'

Version 1.2

August 2005

  • Re-wrote and restructured spec in POD syntax

  • Changed 'name' to be mandatory

  • Changed 'generated_by' to be mandatory

  • Changed 'license' to be mandatory

  • Added version range specifications for prerequisites

  • Added required 'abstract' field

  • Added required 'author' field

  • Added required 'meta-spec' field to define 'version' (and 'url') of the CPAN Meta Spec used for metadata

  • Added 'provides' field

  • Added 'no_index' field and deprecated 'private' field. 'no_index' subkeys include 'file', 'dir', 'package' and 'namespace'

  • Added 'keywords' field

  • Added 'resources' field with subkeys 'homepage', 'license', and 'bugtracker'

  • Added 'optional_features' field as an alternate under 'recommends'. Includes 'description', 'requires', 'build_requires', 'conflicts', 'requires_packages', 'requires_os' and 'excluded_os' as valid subkeys

  • Removed 'license_uri' field

Version 1.1

May 2003

  • Changed 'version' to be mandatory

  • Added 'private' field

  • Added 'license_uri' field

Version 1.0

March 2003

  • Original release (in HTML format only)

  • Included 'name', 'version', 'license', 'distribution_type', 'requires', 'recommends', 'build_requires', 'conflicts', 'dynamic_config', 'generated_by'

AUTHORS

  • David Golden <dagolden@cpan.org>

  • Ricardo Signes <rjbs@cpan.org>

  • Adam Kennedy <adamk@cpan.org>

COPYRIGHT AND LICENSE

This software is copyright (c) 2010 by David Golden, Ricardo Signes, Adam Kennedy and Contributors.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.