Security Advisories (25)
CVE-2018-6798 (2018-04-17)

An issue was discovered in Perl 5.22 through 5.26. Matching a crafted locale dependent regular expression can cause a heap-based buffer over-read and potentially information disclosure.

CVE-2026-4176 (2026-03-29)

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.

CVE-2018-6913 (2018-04-17)

Heap-based buffer overflow in the pack function in Perl before 5.26.2 allows context-dependent attackers to execute arbitrary code via a large item count.

CVE-2018-18314 (2018-12-07)

Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2017-12883 (2017-09-19)

Buffer overflow in the S_grok_bslash_N function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\\N{U+...}' escape.

CVE-2016-6185 (2016-08-02)

The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.

CVE-2015-8608 (2017-02-07)

The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.

CVE-2018-6797 (2018-04-17)

An issue was discovered in Perl 5.18 through 5.26. A crafted regular expression can cause a heap-based buffer overflow, with control over the bytes written.

CVE-2026-19487 (2026-08-13)

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2026-13221 (2026-07-13)

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.

CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

CVE-2026-57432 (2026-07-13)

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

CVE-2026-8376 (2026-05-25)

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.

CVE-2016-1238 (2016-08-02)

(1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6) cpan/Encode/bin/enc2xs, (7) cpan/Encode/bin/encguess, (8) cpan/Encode/bin/piconv, (9) cpan/Encode/bin/ucmlint, (10) cpan/Encode/bin/unidump, (11) cpan/ExtUtils-MakeMaker/bin/instmodsh, (12) cpan/IO-Compress/bin/zipdetails, (13) cpan/JSON-PP/bin/json_pp, (14) cpan/Test-Harness/bin/prove, (15) dist/ExtUtils-ParseXS/lib/ExtUtils/xsubpp, (16) dist/Module-CoreList/corelist, (17) ext/Pod-Html/bin/pod2html, (18) utils/c2ph.PL, (19) utils/h2ph.PL, (20) utils/h2xs.PL, (21) utils/libnetcfg.PL, (22) utils/perlbug.PL, (23) utils/perldoc.PL, (24) utils/perlivp.PL, and (25) utils/splain.PL in Perl 5.x before 5.22.3-RC2 and 5.24 before 5.24.1-RC2 do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2020-12723 (2020-06-05)

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVE-2020-10878 (2020-06-05)

Perl before 5.30.3 has an integer overflow related to mishandling of a "PL_regkind[OP(n)] == NOTHING" situation. A crafted regular expression could lead to malformed bytecode with a possibility of instruction injection.

CVE-2020-10543 (2020-06-05)

Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers have an integer overflow.

CVE-2018-18313 (2018-12-07)

Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.

CVE-2018-18312 (2018-12-05)

Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2018-18311 (2018-12-07)

Perl before 5.26.3 and 5.28.x before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid write operations.

CVE-2017-12837 (2017-09-19)

Heap-based buffer overflow in the S_regatom function in regcomp.c in Perl 5 before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 allows remote attackers to cause a denial of service (out-of-bounds write) via a regular expression with a '\\N{}' escape and the case-insensitive modifier.

CVE-2015-8853 (2016-05-25)

The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-dependent attackers to cause a denial of service (infinite loop) via crafted utf-8 data, as demonstrated by "a\x80."

CVE-2023-47039 (2023-10-30)

Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed.

CVE-2023-47100

In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a \p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.

NAME

List::Util - A selection of general-utility list subroutines

SYNOPSIS

use List::Util qw(first max maxstr min minstr reduce shuffle sum);

DESCRIPTION

List::Util contains a selection of subroutines that people have expressed would be nice to have in the perl core, but the usage would not really be high enough to warrant the use of a keyword, and the size so small such that being individual extensions would be wasteful.

By default List::Util does not export any subroutines.

LIST-REDUCTION FUNCTIONS

The following set of functions all reduce a list down to a single value.

$result = reduce { BLOCK } @list

Reduces @list by calling BLOCK in a scalar context multiple times, setting $a and $b each time. The first call will be with $a and $b set to the first two elements of the list, subsequent calls will be done by setting $a to the result of the previous call and $b to the next element in the list.

Returns the result of the last call to the BLOCK. If @list is empty then undef is returned. If @list only contains one element then that element is returned and BLOCK is not executed.

The following examples all demonstrate how reduce could be used to implement the other list-reduction functions in this module. (They are not in fact implemented like this, but instead in a more efficient manner in individual C functions).

$foo = reduce { defined($a)            ? $a :
                $code->(local $_ = $b) ? $b :
                                         undef } undef, @list # first

$foo = reduce { $a > $b ? $a : $b } 1..10       # max
$foo = reduce { $a gt $b ? $a : $b } 'A'..'Z'   # maxstr
$foo = reduce { $a < $b ? $a : $b } 1..10       # min
$foo = reduce { $a lt $b ? $a : $b } 'aa'..'zz' # minstr
$foo = reduce { $a + $b } 1 .. 10               # sum
$foo = reduce { $a . $b } @bar                  # concat

$foo = reduce { $a || $code->(local $_ = $b) } 0, @bar   # any
$foo = reduce { $a && $code->(local $_ = $b) } 1, @bar   # all
$foo = reduce { $a && !$code->(local $_ = $b) } 1, @bar  # none
$foo = reduce { $a || !$code->(local $_ = $b) } 0, @bar  # notall
   # Note that these implementations do not fully short-circuit

If your algorithm requires that reduce produce an identity value, then make sure that you always pass that identity value as the first argument to prevent undef being returned

$foo = reduce { $a + $b } 0, @values;             # sum with 0 identity value

The remaining list-reduction functions are all specialisations of this generic idea.

any

my $bool = any { BLOCK } @list;

Since version 1.33.

Similar to grep in that it evaluates BLOCK setting $_ to each element of @list in turn. any returns true if any element makes the BLOCK return a true value. If BLOCK never returns true or @list was empty then it returns false.

Many cases of using grep in a conditional can be written using any instead, as it can short-circuit after the first true result.

if( any { length > 10 } @strings ) {
    # at least one string has more than 10 characters
}

all

my $bool = all { BLOCK } @list;

Since version 1.33.

Similar to "any", except that it requires all elements of the @list to make the BLOCK return true. If any element returns false, then it returns false. If the BLOCK never returns false or the @list was empty then it returns true.

none

notall

my $bool = none { BLOCK } @list;

my $bool = notall { BLOCK } @list;

Since version 1.33.

Similar to "any" and "all", but with the return sense inverted. none returns true only if no value in the @list causes the BLOCK to return true, and notall returns true only if not all of the values do.

first

my $val = first { BLOCK } @list;

Similar to grep in that it evaluates BLOCK setting $_ to each element of @list in turn. first returns the first element where the result from BLOCK is a true value. If BLOCK never returns true or @list was empty then undef is returned.

$foo = first { defined($_) } @list    # first defined value in @list
$foo = first { $_ > $value } @list    # first value in @list which
                                      # is greater than $value

max

my $num = max @list;

Returns the entry in the list with the highest numerical value. If the list is empty then undef is returned.

$foo = max 1..10                # 10
$foo = max 3,9,12               # 12
$foo = max @bar, @baz           # whatever

maxstr

my $str = maxstr @list;

Similar to "max", but treats all the entries in the list as strings and returns the highest string as defined by the gt operator. If the list is empty then undef is returned.

$foo = maxstr 'A'..'Z'          # 'Z'
$foo = maxstr "hello","world"   # "world"
$foo = maxstr @bar, @baz        # whatever

min

my $num = min @list;

Similar to "max" but returns the entry in the list with the lowest numerical value. If the list is empty then undef is returned.

$foo = min 1..10                # 1
$foo = min 3,9,12               # 3
$foo = min @bar, @baz           # whatever

minstr

my $str = minstr @list;

Similar to "min", but treats all the entries in the list as strings and returns the lowest string as defined by the lt operator. If the list is empty then undef is returned.

$foo = minstr 'A'..'Z'          # 'A'
$foo = minstr "hello","world"   # "hello"
$foo = minstr @bar, @baz        # whatever

product

my $num = product @list;

Since version 1.35.

Returns the numerical product of all the elements in @list. If @list is empty then 1 is returned.

$foo = product 1..10            # 3628800
$foo = product 3,9,12           # 324

sum

my $num_or_undef = sum @list;

Returns the numerical sum of all the elements in @list. For backwards compatibility, if @list is empty then undef is returned.

$foo = sum 1..10                # 55
$foo = sum 3,9,12               # 24
$foo = sum @bar, @baz           # whatever

sum0

my $num = sum0 @list;

Since version 1.26.

Similar to "sum", except this returns 0 when given an empty list, rather than undef.

KEY/VALUE PAIR LIST FUNCTIONS

The following set of functions, all inspired by List::Pairwise, consume an even-sized list of pairs. The pairs may be key/value associations from a hash, or just a list of values. The functions will all preserve the original ordering of the pairs, and will not be confused by multiple pairs having the same "key" value - nor even do they require that the first of each pair be a plain string.

NOTE: At the time of writing, the following pair* functions that take a block do not modify the value of $_ within the block, and instead operate using the $a and $b globals instead. This has turned out to be a poor design, as it precludes the ability to provide a pairsort function. Better would be to pass pair-like objects as 2-element array references in $_, in a style similar to the return value of the pairs function. At some future version this behaviour may be added.

Until then, users are alerted NOT to rely on the value of $_ remaining unmodified between the outside and the inside of the control block. In particular, the following example is UNSAFE:

my @kvlist = ...

foreach (qw( some keys here )) {
   my @items = pairgrep { $a eq $_ } @kvlist;
   ...
}

Instead, write this using a lexical variable:

foreach my $key (qw( some keys here )) {
   my @items = pairgrep { $a eq $key } @kvlist;
   ...
}

pairs

my @pairs = pairs @kvlist;

Since version 1.29.

A convenient shortcut to operating on even-sized lists of pairs, this function returns a list of ARRAY references, each containing two items from the given list. It is a more efficient version of

@pairs = pairmap { [ $a, $b ] } @kvlist

It is most convenient to use in a foreach loop, for example:

foreach my $pair ( pairs @KVLIST ) {
   my ( $key, $value ) = @$pair;
   ...
}

Since version 1.39 these ARRAY references are blessed objects, recognising the two methods key and value. The following code is equivalent:

foreach my $pair ( pairs @KVLIST ) {
   my $key   = $pair->key;
   my $value = $pair->value;
   ...
}

unpairs

my @kvlist = unpairs @pairs

Since version 1.42.

The inverse function to pairs; this function takes a list of ARRAY references containing two elements each, and returns a flattened list of the two values from each of the pairs, in order. This is notionally equivalent to

my @kvlist = map { @{$_}[0,1] } @pairs

except that it is implemented more efficiently internally. Specifically, for any input item it will extract exactly two values for the output list; using undef if the input array references are short.

Between pairs and unpairs, a higher-order list function can be used to operate on the pairs as single scalars; such as the following near-equivalents of the other pair* higher-order functions:

@kvlist = unpairs grep { FUNC } pairs @kvlist
# Like pairgrep, but takes $_ instead of $a and $b

@kvlist = unpairs map { FUNC } pairs @kvlist
# Like pairmap, but takes $_ instead of $a and $b

Note however that these versions will not behave as nicely in scalar context.

Finally, this technique can be used to implement a sort on a keyvalue pair list; e.g.:

@kvlist = unpairs sort { $a->key cmp $b->key } pairs @kvlist

pairkeys

my @keys = pairkeys @kvlist;

Since version 1.29.

A convenient shortcut to operating on even-sized lists of pairs, this function returns a list of the the first values of each of the pairs in the given list. It is a more efficient version of

@keys = pairmap { $a } @kvlist

pairvalues

my @values = pairvalues @kvlist;

Since version 1.29.

A convenient shortcut to operating on even-sized lists of pairs, this function returns a list of the the second values of each of the pairs in the given list. It is a more efficient version of

@values = pairmap { $b } @kvlist

pairgrep

my @kvlist = pairgrep { BLOCK } @kvlist;

my $count = pairgrep { BLOCK } @kvlist;

Since version 1.29.

Similar to perl's grep keyword, but interprets the given list as an even-sized list of pairs. It invokes the BLOCK multiple times, in scalar context, with $a and $b set to successive pairs of values from the @kvlist.

Returns an even-sized list of those pairs for which the BLOCK returned true in list context, or the count of the number of pairs in scalar context. (Note, therefore, in scalar context that it returns a number half the size of the count of items it would have returned in list context).

@subset = pairgrep { $a =~ m/^[[:upper:]]+$/ } @kvlist

As with grep aliasing $_ to list elements, pairgrep aliases $a and $b to elements of the given list. Any modifications of it by the code block will be visible to the caller.

pairfirst

my ( $key, $val ) = pairfirst { BLOCK } @kvlist;

my $found = pairfirst { BLOCK } @kvlist;

Since version 1.30.

Similar to the "first" function, but interprets the given list as an even-sized list of pairs. It invokes the BLOCK multiple times, in scalar context, with $a and $b set to successive pairs of values from the @kvlist.

Returns the first pair of values from the list for which the BLOCK returned true in list context, or an empty list of no such pair was found. In scalar context it returns a simple boolean value, rather than either the key or the value found.

( $key, $value ) = pairfirst { $a =~ m/^[[:upper:]]+$/ } @kvlist

As with grep aliasing $_ to list elements, pairfirst aliases $a and $b to elements of the given list. Any modifications of it by the code block will be visible to the caller.

pairmap

my @list = pairmap { BLOCK } @kvlist;

my $count = pairmap { BLOCK } @kvlist;

Since version 1.29.

Similar to perl's map keyword, but interprets the given list as an even-sized list of pairs. It invokes the BLOCK multiple times, in list context, with $a and $b set to successive pairs of values from the @kvlist.

Returns the concatenation of all the values returned by the BLOCK in list context, or the count of the number of items that would have been returned in scalar context.

@result = pairmap { "The key $a has value $b" } @kvlist

As with map aliasing $_ to list elements, pairmap aliases $a and $b to elements of the given list. Any modifications of it by the code block will be visible to the caller.

See "KNOWN BUGS" for a known-bug with pairmap, and a workaround.

OTHER FUNCTIONS

shuffle

my @values = shuffle @values;

Returns the values of the input in a random order

@cards = shuffle 0..51      # 0..51 in a random order

KNOWN BUGS

RT #95409

https://rt.cpan.org/Ticket/Display.html?id=95409

If the block of code given to "pairmap" contains lexical variables that are captured by a returned closure, and the closure is executed after the block has been re-used for the next iteration, these lexicals will not see the correct values. For example:

my @subs = pairmap {
   my $var = "$a is $b";
   sub { print "$var\n" };
} one => 1, two => 2, three => 3;

$_->() for @subs;

Will incorrectly print

three is 3
three is 3
three is 3

This is due to the performance optimisation of using MULTICALL for the code block, which means that fresh SVs do not get allocated for each call to the block. Instead, the same SV is re-assigned for each iteration, and all the closures will share the value seen on the final iteration.

To work around this bug, surround the code with a second set of braces. This creates an inner block that defeats the MULTICALL logic, and does get fresh SVs allocated each time:

my @subs = pairmap {
   {
      my $var = "$a is $b";
      sub { print "$var\n"; }
   }
} one => 1, two => 2, three => 3;

This bug only affects closures that are generated by the block but used afterwards. Lexical variables that are only used during the lifetime of the block's execution will take their individual values for each invocation, as normal.

SUGGESTED ADDITIONS

The following are additions that have been requested, but I have been reluctant to add due to them being very simple to implement in perl

# How many elements are true

sub true { scalar grep { $_ } @_ }

# How many elements are false

sub false { scalar grep { !$_ } @_ }

SEE ALSO

Scalar::Util, List::MoreUtils

COPYRIGHT

Copyright (c) 1997-2007 Graham Barr <gbarr@pobox.com>. All rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.

Recent additions and current maintenance by Paul Evans, <leonerd@leonerd.org.uk>.