/ 
perl-5.45.1
⭐ Starred 2013 / release_schedule
Security Advisories (1)
CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

NAME

release_schedule - Perl 5 release schedule

STABLE RELEASE SCHEDULE

This schedule lists the projected or historical development and release schedules for the next, current and previous stable versions of Perl. Dates with two or more question marks will only be releases if deemed necessary by the Steering Council.

Perl 5.44

2026-07-15  5.44.0  ✓       Leon Timmermans

Perl 5.42

2025-07-02  5.42.0  ✓       Philippe Bruhat
2026-03-08  5.42.1  ✓       Steve Hay
2026-03-29  5.42.2  ✓       Steve Hay
2026-08-02  5.42.3          Steve Hay

DEVELOPMENT RELEASE SCHEDULE

This schedule lists the release engineers for at least the next four months of releases of bleadperl. If there are fewer than four months listed as you make a release, it's important that you extend the schedule AND identify the next release engineer.

Before adding a release engineer, you must contact them and they must consent to ship the release.

When shipping a release, you should include the schedule for (at least) the next four releases. If a stable version of Perl is released, you should reset the version numbers to the next blead series.

Perl 5.45

2026-07-15  5.45.0  ✓       Leon Timmermans   (tag only)
2026-07-??  5.45.1          Paul Evans

VICTIMS

The following porters have all consented to do at least one release of bleadperl. If you can't do a release and can't find a substitute amongst this list, mail p5p.

(Please do not add any names to this list without prior consent of the Steering Council.)

Abigail <abigail@abigail.be>
Aristotle Pagaltzis <pagaltzis@gmx.de>
Ask Bjørn Hansen <ask@perl.org>
Chris Williams <chris@bingosnet.co.uk>
Dave Cross <dave@perlhacks.com>
Dave Rolsky <autarch@urth.org>
David Golden <dagolden@cpan.org>
Florian Ragwitz <rafl@debian.org>
Jesse Luehrs <doy@cpan.org>
Jesse Vincent <jesse@cpan.org>
Karen Etheridge <perl@froods.org>
Leon Brocard <acme@astray.com>
Matt Trout <mst@shadowcat.co.uk>
Matthew Horsfall <wolfsage@gmail.com>
Max Maischein <corion@cpan.org>
Paul Evans <leonerd@leonerd.org.uk>
Peter Martini <petercmartini@gmail.com>
Philippe Bruhat <book@cpan.org>
Ricardo Signes <rjbs@cpan.org>
Stevan Little <stevan@cpan.org>
Steve Hay <steve.m.hay@googlemail.com>
Tatsuhiko Miyagawa <miyagawa@bulknews.net>
Thibault Duponchelle <thibault.duponchelle@gmail.com>
Tony Cook <tony@develop-help.com>
Yves Orton <demerphq@gmail.com>
Ævar Arnfjörð Bjarmason <avar@cpan.org>

AUTHOR

Jesse Vincent <jesse@cpan.org>