perl-devel August 2026

perl-devel@lists.fedoraproject.org

2 participants
197 discussions

[Bug 2520301] New: CVE-2022-4993 perl-HTML-FormHandler: HTML::FormHandler: Denial of Service via crafted error messages [fedora-all]
by bugzilla＠redhat.com 13 Sep '26

13 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2520301 Bug ID: 2520301 Summary: CVE-2022-4993 perl-HTML-FormHandler: HTML::FormHandler: Denial of Service via crafted error messages [fedora-all] Product: Fedora Version: rawhide Status: NEW Whiteboard: {"flaws": ["64fbd072-c8ab-4fbc-bb2f-781bec245ab6"]} Component: perl-HTML-FormHandler Keywords: Security, SecurityTracking Severity: high Priority: high Assignee: emmanuel(a)seyman.fr Reporter: lpardo(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: emmanuel(a)seyman.fr, perl-devel(a)lists.fedoraproject.org Blocks: 2515449 (CVE-2022-4993) Target Milestone: --- Classification: Fedora Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error hands its first argument to the language handle as the Locale::Maketext message key, and the default handle's lexicon sets `_AUTO`, so a string that is not a lexicon entry is compiled as a bracket notation template instead of being looked up. In a bracket group the first token names a method called on the language handle and the remaining tokens are its arguments. Three kinds of text the library did not author reach that position. _apply_actions installs a `$SIG{__WARN__}` handler that stores the warning text in `$error_message`, and a captured warning survives a successful action, so a field carrying a numeric transform turns `Argument "[sprintf,%50000000d,0]" isn't numeric` into the template; a warning quotes the submitted value verbatim, so the group is well formed and dispatches. `$error_message ||= $tobj->validate($new_value)` takes a type constraint's own failure message, which renders the rejected value through a partial dumper in bracket and comma form (Devel::PartialDump when Moose can load it, Type::Tiny's own dumper always), so a field with `apply => [ Str ]` given a parameter sent more than once, which arrives as an array, gets `Reference ["a","b"] did not pass type constraint "Str"` as its template, from a request that carries no bracket character of its own. A coercion or transform exception reaches it the same way. Beyond those, a validator whose message contains the field value puts that value in the template directly, and add_error replaces the message list with the contents of an arrayref first argument (`@message = @{$message[0]} if ref $message[0] eq 'ARRAY'`), so a value arriving as an array fills the argument slots from the same request as well. A malformed group such as `[0]` makes the compile croak, and HTML::FormHandler::I18N::maketext and add_error each re-raise that as a die, so process() throws. A well formed group naming sprintf reaches CORE::sprintf with an attacker chosen field width. Any caller that applies a type constraint or a transform to an untrusted field, or whose validator passes an untrusted field value to add_error, can be made to throw an unhandled exception out of process(), or to allocate an arbitrary amount of memory in one request, and an application whose language handle subclass defines side effecting public methods makes those callable with attacker chosen arguments. The dumped type constraint message is bounded to the exception, because both dumpers quote non-numeric elements so the method slot is never an attacker chosen name. The built-in messages pass fixed templates with the value in an argument slot, where it stays inert, and the built-in field types attach explicit message callbacks, so neither is affected. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2515449 [Bug 2515449] CVE-2022-4993 perl-HTML-FormHandler: HTML::FormHandler: Denial of Service via crafted error messages -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2520301 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 9

[Bug 2460563] New: Add perl-Text-BibTeX to EPEL 10 and 9
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2460563 Bug ID: 2460563 Summary: Add perl-Text-BibTeX to EPEL 10 and 9 Product: Fedora Version: rawhide Status: NEW Component: perl-Text-BibTeX Assignee: cbm(a)m.fsf.org Reporter: ppisar(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: cbm(a)m.fsf.org, perl-devel(a)lists.fedoraproject.org Blocks: 2460458 Target Milestone: --- Classification: Fedora Could you please add perl-Text-BibTeX to EPEL 10 and 9? I need it there for biber. Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2460458 [Bug 2460458] Please branch and build biber for EPEL9/10 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2460563 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 20

[Bug 2526097] New: perl-Mail-JMAPTalk-0.18 is available
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2526097 Bug ID: 2526097 Summary: perl-Mail-JMAPTalk-0.18 is available Product: Fedora Version: rawhide Status: NEW Component: perl-Mail-JMAPTalk Keywords: FutureFeature, Triaged Assignee: mspacek(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: mspacek(a)redhat.com, perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 0.18 Upstream release that is considered latest: 0.18 Current version/release in rawhide: 0.17-4.fc45 URL: http://search.cpan.org/dist/Mail-JMAPTalk/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12500/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-Mail-JMAPTalk -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2526097 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 6

[Bug 2526104] New: perl-Text-VCardFast-0.12 is available
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2526104 Bug ID: 2526104 Summary: perl-Text-VCardFast-0.12 is available Product: Fedora Version: rawhide Status: NEW Component: perl-Text-VCardFast Keywords: FutureFeature, Triaged Assignee: mspacek(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: mspacek(a)redhat.com, perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 0.12 Upstream release that is considered latest: 0.12 Current version/release in rawhide: 0.11-34.fc45 URL: http://search.cpan.org/dist/Text-VCardFast/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/12494/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-Text-VCardFast -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2526104 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 3

[Bug 2524288] New: perl-DBD-Mock-1.60 is available
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2524288 Bug ID: 2524288 Summary: perl-DBD-Mock-1.60 is available Product: Fedora Version: rawhide Status: NEW Component: perl-DBD-Mock Keywords: FutureFeature, Triaged Assignee: ppisar(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: lkundrak(a)v3.sk, perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com Target Milestone: --- Classification: Fedora Releases retrieved: 1.60 Upstream release that is considered latest: 1.60 Current version/release in rawhide: 1.59-16.fc45 URL: http://search.cpan.org/dist/DBD-Mock/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2805/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-DBD-Mock -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2524288 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 13

[Bug 2526253] New: Upgrade to perl-Finance-Quote-1.71
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2526253 Bug ID: 2526253 Summary: Upgrade to perl-Finance-Quote-1.71 Product: Fedora Version: rawhide URL: https://metacpan.org/dist/Finance-Quote Status: NEW Component: perl-Finance-Quote Assignee: gwync(a)protonmail.com Reporter: jplesnik(a)redhat.com QA Contact: extras-qa(a)fedoraproject.org CC: gwync(a)protonmail.com, paul(a)city-fan.org, perl-devel(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Latest Fedora delivers 1.7000 version. Upstream released 1.71. When you have free time, please upgrade it. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2526253 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 19

[Bug 2526041] New: perl-DateTime-1.67 is available
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2526041 Bug ID: 2526041 Summary: perl-DateTime-1.67 is available Product: Fedora Version: rawhide Status: NEW Component: perl-DateTime Keywords: FutureFeature, Triaged Assignee: paul(a)city-fan.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: paul(a)city-fan.org, perl-devel(a)lists.fedoraproject.org, steve(a)silug.org Target Milestone: --- Classification: Fedora Releases retrieved: 1.67 Upstream release that is considered latest: 1.67 Current version/release in rawhide: 1.66-7.fc45 URL: http://search.cpan.org/dist/DateTime/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2787/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-DateTime -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2526041 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 7

[Bug 2526086] New: perl-CPAN-Meta-2.150014 is available
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2526086 Bug ID: 2526086 Summary: perl-CPAN-Meta-2.150014 is available Product: Fedora Version: rawhide Status: NEW Component: perl-CPAN-Meta Keywords: FutureFeature, Triaged Assignee: paul(a)city-fan.org Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: paul(a)city-fan.org, perl-devel(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Releases retrieved: 2.150014 Upstream release that is considered latest: 2.150014 Current version/release in rawhide: 2.150013-527.fc45 URL: http://search.cpan.org/dist/CPAN-Meta/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/6625/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-CPAN-Meta -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2526086 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 8

[Bug 2525604] New: perl-Compress-Raw-Zlib-2.224 is available
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2525604 Bug ID: 2525604 Summary: perl-Compress-Raw-Zlib-2.224 is available Product: Fedora Version: rawhide Status: NEW Component: perl-Compress-Raw-Zlib Keywords: FutureFeature, Triaged Assignee: jplesnik(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: jplesnik(a)redhat.com, mspacek(a)redhat.com, paul(a)city-fan.org, perl-devel(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Releases retrieved: 2.224 Upstream release that is considered latest: 2.224 Current version/release in rawhide: 2.222-528.fc45 URL: https://metacpan.org/dist/Compress-Raw-Zlib/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2712/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-Compress-Raw-Zlib -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2525604 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 5

[Bug 2525603] New: perl-Compress-Raw-Bzip2-2.224 is available
by bugzilla＠redhat.com 11 Sep '26

11 Sep '26

https://bugzilla.redhat.com/show_bug.cgi?id=2525603 Bug ID: 2525603 Summary: perl-Compress-Raw-Bzip2-2.224 is available Product: Fedora Version: rawhide Status: NEW Component: perl-Compress-Raw-Bzip2 Keywords: FutureFeature, Triaged Assignee: jplesnik(a)redhat.com Reporter: upstream-release-monitoring(a)fedoraproject.org QA Contact: extras-qa(a)fedoraproject.org CC: jplesnik(a)redhat.com, mspacek(a)redhat.com, paul(a)city-fan.org, perl-devel(a)lists.fedoraproject.org Target Milestone: --- Classification: Fedora Releases retrieved: 2.224 Upstream release that is considered latest: 2.224 Current version/release in rawhide: 2.218-527.fc45 URL: https://metacpan.org/dist/Compress-Raw-Bzip2/ Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_M… Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/2711/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/perl-Compress-Raw-Bzip2 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2525603 Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…

1 5

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

perl-devel August 2026