Perl 5.42.3

Perl 5.42.3 ships today. Security release. Three core CVEs patched. No breaking changes. Four months of work from 14 authors, packed into ~4,000 lines of changes.

Security Fixes

• CVE-2026-8376 — Buffer overflow in Perl_study_chunk. The regex compiler checked the joined-substring buffer size in characters instead of bytes; on 32-bit builds this can overflow the buffer and cause out-of-bounds writes.
• CVE-2026-57432 — Buffer overflow in S_measure_struct. pack/unpack on a structure with a huge repeat count can overflow an integer and smash the buffer. A new fatal diagnostic, "Pack template structure size is too large", now fires instead.
• CVE-2026-13221 — Regex trie 16-bit field overflow. Alternations with more than ~65k branches could overflow the trie optimization, producing false positives and false negatives.

Module Updates

• Archive::Tar 3.04 → 3.12 — fixes CVE-2026-9538, CVE-2026-42496, CVE-2026-42497.
• HTTP::Tiny 0.090 → 0.096 — fixes CVE-2026-7010, CVE-2026-7017.
• IO::Compress 2.213 → 2.223 — fixes CVE-2025-15649, CVE-2026-48961, CVE-2026-48962, CVE-2026-48959.
• Socket 2.038 → 2.041 — fixes CVE-2026-12087.
• Storable 3.37 → 3.37_01 — fixes CVE-2026-57433.
• Compress::Raw::Bzip2 2.213 → 2.218; Module::CoreList refreshed to 5.20260802_42.

Compatibility

No changes intentionally incompatible with 5.42.2. If you find one, it's a bug — report it.

Upgrade now. This is a security release. The fix list is long and the breaking-change list is empty.