Perl 5.x — End of Life
Active Critical risk EOL: Jul 15, 2029in 1012d10 releases in this series4 CVEs
Perl 5.x is partially supported: only 5.44, 5.42, 5.40 still receive security fixes, the longest-lived (5.44) until Jul 15, 2029, in 1012 days. The most recent release in this series is 5.44.0. 4 CVEs are tracked for this series, including 3 critical. 4 of them were published after the end of life of the affected cycle and will not get an official patch.
Perl 5.x — All releases
| Version | Released | Active support | EOL date | Latest patch | Status | Alert me |
|---|---|---|---|---|---|---|
| 5.44 | Jul 15, 2026 | — | Jul 15, 2029 | 5.44.0 | Active | |
| 5.42 | Jul 3, 2025 | — | Jul 3, 2028 | 5.42.3 | Active | |
| 5.40 | Jun 9, 2024 | Jul 15, 2026 | Jun 9, 2027 | 5.40.5 | Active | |
| 5.38 | Jul 2, 2023 | Jul 3, 2025 | Jul 2, 2026 | 5.38.5 | EOL | |
| 5.36 | May 27, 2022 | Jun 9, 2024 | May 27, 2025 | 5.36.3 | EOL | |
| 5.34 | May 20, 2021 | Jul 2, 2023 | May 20, 2024 | 5.34.3 | EOL | |
| 5.32 | Jun 20, 2020 | May 27, 2022 | Jun 20, 2023 | 5.32.1 | EOL | |
| 5.30 | May 22, 2019 | May 20, 2021 | May 22, 2022 | 5.30.3 | EOL | |
| 5.28 | Jun 22, 2018 | Jun 20, 2020 | Jun 23, 2021 | 5.28.3 | EOL | |
| 5.26 | May 30, 2017 | May 22, 2019 | May 30, 2020 | 5.26.3 | EOL |
CVEs affecting Perl 5.x (36)
| CVE | Severity | CVSS | EPSS | KEV | Cycle | Description | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.38 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.30 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.34 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.40 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.32 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.42 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.28 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.26 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-57432 | HIGH | 8.4 | 0.21% | — | 5.36 | Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.26 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.38 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.30 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.42 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.36 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.32 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.34 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.28 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-13221 | CRITICAL | 9.1 | 0.43% | — | 5.40 | Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 6553… | Jul 13, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.26 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.36 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.42 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.32 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.40 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.30 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.38 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.28 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-8376 | CRITICAL | 9.8 | 0.48% | — | 5.34 | Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed strin… | May 26, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.38 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.40 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.32 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.34 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.28 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.42 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.30 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.26 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
| CVE-2026-4176 | CRITICAL | 9.8 | 0.81% | — | 5.36 | Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl… | Mar 29, 2026 |
Add a Perl 5 EOL badge to your README
Show your users which Perl version your project runs and whether it is still supported. The badge updates automatically. More formats and options →
[](https://eolcanary.com/explore/perl/5)Frequently asked questions
Is Perl 5 end of life?
Partially. 7 of the 10 Perl 5.x releases have reached end of life. Still supported: 5.44, 5.42, 5.40 (until July 15, 2029 at the latest).
What CVEs affect Perl 5?
There are 4 CVEs tracked for Perl 5.x, including 3 critical severity issues. See the full list above with CVSS and EPSS scores.
What is the latest Perl 5 version?
The latest Perl 5.x patch release is 5.44.0, released on July 15, 2026. Always run the latest patch to benefit from all security fixes.
When was Perl 5 first released?
Perl 5.26 was released on May 30, 2017. See the full version timeline in the table above.
Is it safe to run Perl 5 in production?
Only on a supported release (5.44, 5.42, 5.40). Support for Perl 5.44 ends on July 15, 2029. Make sure you run the latest patch (5.44.0) to have all security fixes applied.
Data sourced from endoflife.date · CVE data from NVD · EPSS from FIRST.org · KEV from CISA