/ 
perl-5.42.0
⭐ Starred 2013 / experimental
Security Advisories (4)
CVE-2026-8376 (2026-05-25)

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2026-13221 (2026-07-13)

Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2026-57432 (2026-07-13)

Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

NAME

experimental - Experimental features made easy

VERSION

version 0.035

SYNOPSIS

use experimental 'lexical_subs', 'signatures';
my sub plus_one($value) { $value + 1 }

DESCRIPTION

This pragma provides an easy and convenient way to enable or disable experimental features.

Every version of perl has some number of features present but considered "experimental." For much of the life of Perl 5, this was only a designation found in the documentation. Starting in Perl v5.10.0, and more aggressively in v5.18.0, experimental features were placed behind pragmata used to enable the feature and disable associated warnings.

The experimental pragma exists to combine the required incantations into a single interface stable across releases of perl. For every experimental feature, this should enable the feature and silence warnings for the enclosing lexical scope:

use experimental 'feature-name';

To disable the feature and, if applicable, re-enable any warnings, use:

no experimental 'feature-name';

The supported features, documented further below, are:

  • args_array_with_signatures - allow @_ to be used in signatured subs.

    This is supported on perl 5.20.0 and above, but is likely to be removed in the future.

  • array_base - allow the use of $[ to change the starting index of @array.

    This was removed in perl 5.30.0.

  • autoderef - allow push, each, keys, and other built-ins on references.

    This was added in perl 5.14.0 and removed in perl 5.24.0.

  • bitwise - allow the new stringwise bit operators

    This was added in perl 5.22.0.

  • builtin - allow the use of the functions in the builtin:: namespace

    This was added in perl 5.36.0

  • const_attr - allow the :const attribute on subs

    This was added in perl 5.22.0.

  • declared_refs - enables aliasing via assignment to references

    This was added in perl 5.26.0.

  • defer - enables the use of defer blocks

    This was added in perl 5.36.0

  • extra_paired_delimiters - enables the use of more paired string delimiters than the traditional four, < >, ( ), { }, and [ ].

    This was added in perl 5.36.

  • for_list - allows iterating over multiple values at a time with for

    This was added in perl 5.36.0

  • isa - allow the use of the isa infix operator

    This was added in perl 5.32.0.

  • lexical_topic - allow the use of lexical $_ via my $_.

    This was added in perl 5.10.0 and removed in perl 5.24.0.

  • lexical_subs - allow the use of lexical subroutines.

    This was added in 5.18.0, and became non-experimental (and always enabled) in 5.26.0.

  • postderef - allow the use of postfix dereferencing expressions

    This was added in perl 5.20.0, and became non-experimental (and always enabled) in 5.24.0.

  • postderef_qq - allow the use of postfix dereferencing expressions inside interpolating strings

    This was added in perl 5.20.0, and became non-experimental (and always enabled) in 5.24.0.

  • re_strict - enables strict mode in regular expressions

    This was added in perl 5.22.0.

  • refaliasing - allow aliasing via \$x = \$y

    This was added in perl 5.22.0.

  • regex_sets - allow extended bracketed character classes in regexps

    This was added in perl 5.18.0, and became non-experimental (and always enabled) in 5.36.0.

    This is documented at "Extended Bracketed Character Classes" in perlrecharclass.

  • signatures - allow subroutine signatures (for named arguments)

    This was added in perl 5.20.0.

  • smartmatch - allow the use of ~~

    This was added in perl 5.10.0, but it should be noted there are significant incompatibilities between 5.10.0 and 5.10.1.

    The feature was deprecated in perl 5.38.0, and undeprecated in 5.42.0.

  • switch - allow the use of ~~, given, and when

    This was added in perl 5.10.0.

    The feature was deprecated in perl 5.38.0, and undeprecated in 5.42.0.

  • try - allow the use of try and catch

    This was added in perl 5.34.0

  • win32_perlio - allows the use of the :win32 IO layer.

    This was added on perl 5.22.0.

Ordering matters

Using this pragma to 'enable an experimental feature' is another way of saying that this pragma will disable the warnings which would result from using that feature. Therefore, the order in which pragmas are applied is important. In particular, you probably want to enable experimental features after you enable warnings:

use warnings;
use experimental 'smartmatch';

You also need to take care with modules that enable warnings for you. A common example being Moose. In this example, warnings for the 'smartmatch' feature are first turned on by the warnings pragma, off by the experimental pragma and back on again by the Moose module (fix is to switch the last two lines):

use warnings;
use experimental 'smartmatch';
use Moose;

Disclaimer

Because of the nature of the features it enables, forward compatibility can not be guaranteed in any way.

SEE ALSO

perlexperiment contains more information about experimental features.

AUTHOR

Leon Timmermans <fawaka@gmail.com>

COPYRIGHT AND LICENSE

This software is copyright (c) 2013 by Leon Timmermans.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.