PERL5283DELTA(1perl)

💖 NAME 💖

perl5283delta — the tea on what's new for perl v5.28.3. This page lives in the Perl Programmers Reference Guide, bestie, and it's here to catch you up. ✨

---

🌸 DESCRIPTION 🌸

okay so this doc describes the differences between the 5.28.2 release and the 5.28.3 release. that's it, that's the assignment. 🫶

and listen — if you're upgrading from an earlier release like 5.28.1, you gotta read perl5282delta first, because that one describes the differences between 5.28.1 and 5.28.2. do it in order, queen. 💅

---

🚨 Security 🚨

bestie this is the part where you sit up straight. three CVEs. all of them regular-expression flavored. not me getting stressed just reading the headings 😭

[CVE-2020-10543] Buffer overflow caused by a crafted regular expression

so there's a signed size_t integer overflow in the storage space calculations for nested regular expression quantifiers, and the way that goes down is it could cause a heap buffer overflow in Perl's regular expression compiler. and that overflow overwrites memory allocated right after the regular expression storage space with data the attacker supplied. it's giving villain arc. 💀

the target system needs a sufficient amount of memory to allocate partial expansions of the nested quantifiers before the overflow can even happen. this requirement is unlikely to be met on 64-bit systems. so like, not great, but also not universal.

Discovered by: ManhND of The Tarantula Team, VinCSS (a member of Vingroup).

[CVE-2020-10878] Integer overflow via malformed bytecode produced by a crafted regular expression

integer overflows in the calculation of offsets between instructions for the regular expression engine could cause corruption of the intermediate language state of a compiled regular expression. and an attacker could abuse this behaviour to insert instructions into the compiled form of a Perl regular expression. that is a whole yikes. 🙈

Discovered by: Hugo van der Sanden and Slaven Rezic.

[CVE-2020-12723] Buffer overflow caused by a crafted regular expression

recursive calls to S_study_chunk() by Perl's regular expression compiler — the ones it makes to optimize the intermediate language representation of a regular expression — could cause corruption of the intermediate language state of a compiled regular expression. iconic function name, un-iconic consequences. 🎀

Discovered by: Sergey Aleynikov.

Additional Note

real talk: an application written in Perl would only be vulnerable to any of the above flaws if it evaluates regular expressions supplied by the attacker. and evaluating regular expressions in this fashion is known to be dangerous since the regular expression engine does not protect against denial of service attacks in this usage scenario. so like, don't eval stranger regexes. periodt. 👑

---

🦋 Incompatible Changes 🦋

there are no changes intentionally incompatible with Perl 5.28.2. if any exist, they are bugs, and we request that you submit a report. see "Reporting Bugs" below. imagine being the one who finds an accidental incompatibility, main character energy fr fr. ✨

---

🎀 Modules and Pragmata 🎀

Updated Modules and Pragmata

• Module::CoreList has been upgraded from version 5.20190419 to 5.20200601_28. slay.

---

🧚 Testing 🧚

tests were added and changed to reflect the other additions and changes in this release. keeping it accountable, we love to see it. 💖

---

💜 Acknowledgements 💜

Perl 5.28.3 represents approximately 13 months of development since Perl 5.28.2 and contains approximately 3,100 lines of changes across 48 files from 16 authors. obsessed with the numbers ngl.

excluding auto-generated files, documentation and release tools, there were approximately 1,700 lines of changes to 9 .pm, .t, .c and .h files. ✨

Perl continues to flourish into its fourth decade thanks to a vibrant community of users and developers. the following people are known to have contributed the improvements that became Perl 5.28.3:

Chris 'BinGOs' Williams, Dan Book, Hugo van der Sanden, James E Keenan, John Lightsey, Karen Etheridge, Karl Williamson, Matthew Horsfall, Max Maischein, Nicolas R., Renee Baecker, Sawyer X, Steve Hay, Tom Hukins, Tony Cook, Zak B. Elep.

the list above is almost certainly incomplete as it is automatically generated from version control history. in particular, it does not include the names of the (very much appreciated) contributors who reported issues to the Perl bug tracker. y'all are the real ones. 🫶

many of the changes included in this version originated in the CPAN modules included in Perl's core. we're grateful to the entire CPAN community for helping Perl to flourish. 🌈

for a more complete list of all of Perl's historical contributors, please see the AUTHORS file in the Perl source distribution.

---

🌸 Reporting Bugs 🌸

if you find what you think is a bug, you might check the perl bug database at https://github.com/Perl/perl5/issues. there may also be information at https://www.perl.org/, the Perl Home Page. 👑

if you believe you have an unreported bug, please open an issue at https://github.com/Perl/perl5/issues. be sure to trim your bug down to a tiny but sufficient test case — we can't debug your entire codebase, bestie, that's not the vibe. 💅

if the bug you are reporting has security implications which make it inappropriate to send to a public issue tracker, then see "SECURITY VULNERABILITY CONTACT INFORMATION" in perlsec for details of how to report the issue. keep it private, keep it safe. 🎀

---

🫶 Give Thanks 🫶

if you wish to thank the Perl 5 Porters for the work we had done in Perl 5, you can do so by running the perlthanks program:

perlthanks

this will send an email to the Perl 5 Porters list with your show of thanks. so cute. so sweet. do it. 💖

---

⭐ SEE ALSO ⭐

• the Changes file for an explanation of how to view exhaustive details on what changed.
• the INSTALL file for how to build Perl.
• the README file for general stuff.
• the Artistic and Copying files for copyright information.

---

and that's the whole page, pookie 💅 this was PERL5283DELTA(1perl), dropped as part of perl v5.44.0 on 2026-10-17. go forth and upgrade responsibly ✨🦋👑