← Packages
perl
Practical Extraction and Report Language
- Current
- 5.42.0
- Candidate
- 5.44.0Stale
- License
- GPL-1.0-or-later OR Artistic-1.0-Perl
Advisory · 4
Provider matches do not establish RPM applicability. Local patches, bundled dependencies and binary artifacts are not evaluated.
- Summary
- Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk. When such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error. A pattern of this shape produces false positive matches (matching strings it should not) and fals…NVD
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.494%FIRST
- Vulnerable CPE criteria
- cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*; <= 5.43.9NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HNVD
- Summary characters omitted
- 136NVD
- Summary
- Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib. Compress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94.NVD
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.74%FIRST
- Vulnerable CPE criteria
- cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*; >= 5.41.0, < 5.42.2, cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*; >= 5.43.0, < 5.43.9, cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*; >= 5.9.4, < 5.40.4NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary
- Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted in…NVD
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.211%FIRST
- Vulnerable CPE criteria
- cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*; <= 5.43.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- Summary characters omitted
- 69NVD
- Summary
- Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer. A caller that compiles an attacker-controlled regular expression on a …NVD
- EPSS model date
- 2026-11-10FIRST
- EPSS probability
- 0.567%FIRST
- Vulnerable CPE criteria
- cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*; <= 5.43.10NVD
- Aliases
- —NVD
- KEV
- NoCISA
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNVD
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LNVD
- Summary characters omitted
- 66NVD
Description
Perl is a high-level programming language with roots in C, sed, awk and shell scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common applications are system administration utilities and web programming. This is a metapackage with all the Perl bits and core modules that can be found in the upstream tarball from perl.org. If you need only a specific feature, you can install a specific package instead. E.g. to handle Perl scripts with /usr/bin/perl interpreter, install perl-interpreter package. See perl-interpreter description for more details on the Perl decomposition into packages.
Changelog
PR · 12
Issue · 1
Checks
| Monitor | Observation | Last checked |
|---|---|---|
Stale Repository refresh: git fetch exited 128 (authentication) | ||
Stale Source last confirmed at 2026-11-10T19:28:57+00:00; repository refresh overdue. | ||
Checked | ||
Checked | ||
Checked Current source cycle 5.42; upstream lifecycle only. | ||
Not configured No reliable monitor identity/configuration. | — | |
Not configured No reliable monitor identity/configuration. | — | |
Checked Current source component only; local patches, build options, bundled dependencies and binary artifacts are not evaluated. | Last attempted | |
Not configured No reliable monitor identity/configuration. | — |