PERLDELTA(1)

✨ PERLDELTA — what's new for perl v5.42.3 ✨

bestie. welcome to the perldelta page, aka the group chat recap of everything that changed in Perl v5.42.3, from the Perl Programmers Reference Guide. pull up a chair, grab a boba, we're doing a vibe check on a whole release 💖

---

🌸 DESCRIPTION 🌸

okay so. this doc is literally just the diff between the 5.42.2 release and the 5.42.3 release. that's it. that's the whole plot 🎀

and if you're hopping in from something even older, like 5.42.1? first read perl5422delta, bestie — that one covers the glow-up from 5.42.1 to 5.42.2. do it in order, no skipping, iykyk 💅

---

🔒 Security 🔒

three (3) CVEs. sit down for these, they're not cute.

🫠 CVE-2026-8376 - Buffer overflow in Perl_study_chunk

so Perl_study_chunk in regcomp_study.c was checking the size of the joined substring buffer in characters instead of bytes. the way that's a problem on 32-bit builds… 😭 it can lead to an integer overflow of the size of the buffer, which then leads to out-of-bounds writes. yeah. no cap. 💀

🫠 CVE-2026-57432 - Buffer overflow in S_measure_struct

if you call pack or unpack on a structure whose computed size is too large to fit in memory, an integer overflow could happen and that results in a buffer overflow. and when does this usually happen? when you embed a large number as the repeat count for an item. so like… don't do that. 🙈

🫠 CVE-2026-13221 - Regex trie 16-bit field overflow

the trie optimization in the regex engine could overflow in an alternation with more than ~65k branches. and the consequence? both false positives AND false negatives on such regular expressions. so it's not even consistent, it's just wrong in both directions. iconic behavior in the worst way ⭐

---

🚫 Incompatible Changes 🚫

good news era: there are no changes intentionally incompatible with 5.42.2.

if any exist? those are bugs, and we are literally requesting that you submit a report. see "Reporting Bugs" below, bestie 🫶

---

📦 Modules and Pragmata 📦

⬆️ Updated Modules and Pragmata

• Archive::Tar — upgraded from version 3.04 to 3.12.
  • this fixes CVE-2026-9538, CVE-2026-42496, and CVE-2026-42497. three-for-one slay 🔥
• Compress::Raw::Bzip2 — upgraded from version 2.213 to 2.218.
• HTTP::Tiny — upgraded from version 0.090 to 0.096.
  • this fixes CVE-2026-7010 and CVE-2026-7017.
• IO::Compress — upgraded from version 2.213 to 2.223.
  • this fixes CVE-2025-15649, CVE-2026-48961, CVE-2026-48962, and CVE-2026-48959.
• Module::CoreList — upgraded from version 5.20260329_42 to 5.20260802_42.
• Socket — upgraded from version 2.038 to 2.041.
  • this fixes CVE-2026-12087.
• Storable — upgraded from version 3.37 to 3.37_01.
  • this fixes CVE-2026-57433.

---

📚 Documentation 📚

✏️ Changes to Existing Documentation

we have attempted to update the docs so they reflect everything listed in this document. and if you find any we missed? open an issue at <https://github.com/Perl/perl5/issues>. we're not mad, we just wanna know 🫶

---

🩺 Diagnostics 🩺

the following additions or changes have been made to diagnostic output — that means warnings and fatal error messages, bestie. for the complete list of diagnostic messages, see perldiag ✨

🆕 New Diagnostics

💥 New Errors

• Pack template structure size is too large
  • (F) — okay so this is a fatal one. you called pack or unpack to operate on a structure whose computed size is too large to fit in memory. this usually happens as a result of embedding a large number as the repeat count for an item. same energy as that CVE up top, fr fr 😭

---

🧪 Testing 🧪

tests were added and changed to reflect the other additions and changes in this release. as they should be. periodt 💅

---

🫶 Acknowledgements 🫶

okay this is the part where we get emo.

Perl 5.42.3 represents approximately 4 months of development since Perl 5.42.2, and contains approximately 4,000 lines of changes across 120 files from 14 authors. 😭 so much work.

excluding auto-generated files, documentation and release tools, there were approximately 1,700 lines of changes to 59 .pm, .t, .c and .h files.

Perl continues to flourish into its fourth decade thanks to a vibrant community of users and developers. and the following people are known to have contributed the improvements that became Perl 5.42.3:

Aristotle Pagaltzis, Chris 'BinGOs' Williams, E. Choroba, Eric Herman, Karen Etheridge, Karl Williamson, Leon Timmermans, Paul Evans, Paul Marquess, Philippe Bruhat (BooK), Richard Leach, Steve Hay, Thibault Duponchelle, Tony Cook.

👑 every single one of them.

ngl, the list above is almost certainly incomplete — it's automatically generated from version control history. in particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker. you're seen, you're loved 🫶

many of the changes included in this version originated in the CPAN modules included in Perl's core. we're grateful to the entire CPAN community for helping Perl to flourish. 🌈

for a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.

---

🐛 Reporting Bugs 🐛

if you find what you think is a bug, you might check the perl bug database at <https://github.com/Perl/perl5/issues>. there may also be info at <https://www.perl.org/>, the Perl Home Page ✨

if you believe you have an unreported bug, please open an issue at <https://github.com/Perl/perl5/issues>.

🎀 be sure to trim your bug down to a tiny but sufficient test case. we love you but we do not love a 400-line repro script, bestie.

if the bug you're reporting has security implications which make it inappropriate to send to a public issue tracker, then see "SECURITY VULNERABILITY CONTACT INFORMATION" in perlsec for details on how to report the issue. 🔐

---

💌 Give Thanks 💌

if you wish to thank the Perl 5 Porters for the work we had done in Perl 5, you can do so by running the perlthanks program:

perlthanks

this will send an email to the Perl 5 Porters list with your show of thanks. 🫶 literally the easiest good deed ever.

---

👀 SEE ALSO 👀

• the Changes file, for an explanation of how to view exhaustive details on what changed.
• the INSTALL file, for how to build Perl.
• the README file, for general stuff.
• the Artistic and Copying files, for copyright information.

---

and that's the whole page, bestie!! this was perl version v5.42.3, dated 2026-08-03, and it was giving very much main character energy from start to finish 💅✨