/ 
perl-5.40.5
⭐ Starred 2013 / deprecate
Security Advisories (3)
CVE-2025-40909 (2025-05-30)

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

CVE-2026-15534 (2026-08-09)

Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch. The regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it. A caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory.

CVE-2026-19487 (2026-08-13)

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

NAME

deprecate - Perl pragma for deprecating the inclusion of a module in core

SYNOPSIS

use deprecate;  # warn about future absence if loaded from core

DESCRIPTION

This pragma simplifies the maintenance of dual-life modules that will no longer be included in the Perl core in a future Perl release, but are still included currently.

The purpose of the pragma is to alert users to the status of such a module by issuing a warning that encourages them to install the module from CPAN, so that a future upgrade to a perl which omits the module will not break their code.

This warning will only be issued if the module was loaded from a core library directory, which allows the use deprecate line to be included in the CPAN version of the module. Because the pragma remains silent when the module is run from a non-core library directory, the pragma call does not need to be patched into or out of either the core or CPAN version of the module. The exact same code can be shipped for either purpose.

Important Caveat

Note that when a module installs from CPAN to a core library directory rather than the site library directories, the user gains no protection from having installed it.

At the same time, this pragma cannot detect when such a module has installed from CPAN to the core library, and so it would endlessly and uselessly exhort the user to upgrade.

Therefore modules that can install from CPAN to the core library must make sure not to call this pragma when they have done so. Generally this means that the exact logic from the installer must be mirrored inside the module. E.g.:

# Makefile.PL
WriteMakefile(
    # ...
    INSTALLDIRS => ( "$]" >= 5.011 ? 'site' : 'perl' ),
);

# lib/Foo/Bar.pm
use if "$]" >= 5.011, 'deprecate';

(The above example shows the most important case of this: when the target is a Perl older than 5.12 (where the core library directories take precedence over the site library directories) and the module being installed was included in core in that Perl version. Under those circumstances, an upgrade of the module from CPAN is only possible by installing to the core library.)

EXPORT

None by default. The only method is import, called by use deprecate;.

SEE ALSO

First example to use deprecate; was Switch.

AUTHOR

Original version by Nicholas Clark

COPYRIGHT AND LICENSE

Copyright (C) 2009, 2011

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.10.0 or, at your option, any later version of Perl 5 you may have available.