kapsl Index
Docs Releases

perl

4 tools · 4 release lines

Perl runtime + cpan/perldoc/prove. Each tool carries its own sandbox boundary — they are not the same.

kapsl perl
kapsl cpan
kapsl perldoc
kapsl prove
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

capabilities differ between them

Tool Capabilities Seccomp Findings Image Description
showing perl cpan perldoc prove from perl@latest → 5.44.0 stable [email protected] → 5.44.0 stable [email protected] → 5.42.3 stable [email protected] → 5.40.5 stable

Findings

M1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-15534 ↗ M 5.7 perl Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

These are the findings of perl, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

M1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-15534 ↗ M 5.7 perl Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

These are the findings of perl, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C2H1M1

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-8376 ↗ C 9.8 perl Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
CVE-2026-13221 ↗ C 9.1 perl Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.
CVE-2026-57432 ↗ H 8.4 perl Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
CVE-2026-15534 ↗ M 5.7 perl Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.

These are the findings of perl, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Findings

C2H1M3

identical on amd64, arm64 — one table describes both

CVE Sev CVSS Affects Description
CVE-2026-8376 ↗ C 9.8 perl Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.
CVE-2026-13221 ↗ C 9.1 perl Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.
CVE-2026-57432 ↗ H 8.4 perl Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.
CVE-2025-40909 ↗ M 5.9 perl Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone…
CVE-2026-15534 ↗ M 5.7 perl Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.
CVE-2026-19487 ↗ M 5.3 perl Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.

These are the findings of perl, which ships every tool in this project. kapsl reports and gates; it never edits an image to clear a finding.

Composition

default + bash, env
runtime none — self-contained
composes bash, env

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + bash, env, g++, gcc, make
runtime none — self-contained
composes bash, env, g++, gcc, make

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + env
runtime none — self-contained
composes env

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Composition

default + bash, env
runtime none — self-contained
composes bash, env

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. kapsl resolves that for you — -e git,python:flake8 composes explicitly.

Image

image ghcr.io/kapsl-sh/perl:5.44.0
digest
platforms
size 85 MB unpacked · 1 layer
base scratch
signed cosign · verified
last scan

Image

image ghcr.io/kapsl-sh/perl:5.44.0
digest
platforms
size 85 MB unpacked · 1 layer
base scratch
signed cosign · verified
last scan

Image

image ghcr.io/kapsl-sh/perl:5.42.3
digest
platforms
size 83 MB unpacked · 1 layer
base scratch
signed cosign · verified
last scan

Image

image ghcr.io/kapsl-sh/perl:5.40.5
digest
platforms
size 84 MB unpacked · 1 layer
base scratch
signed cosign · verified
last scan

Sandbox boundary

perl

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

  • ~/.perldb

env passed through

4 forwarded

PERLIOPERL_HASH_SEEDPERL_PERTURB_KEYSPERL_UNICODE

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

1 set

PERL_BADLANG

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

cpan

capabilities

netrw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

  • ~/.cpan · writable

env passed through

9 forwarded

ALL_PROXYHTTPS_PROXYHTTP_PROXYNO_PROXYall_proxyftp_proxyhttp_proxyhttps_proxyno_proxy

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

4 set

CXXNONINTERACTIVE_TESTINGPERL_BADLANGPERL_MM_USE_DEFAULT

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

perldoc

capabilities

ro

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

none

none

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

1 set

PERL_BADLANG

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Sandbox boundary

prove

capabilities

rw

Filled is granted to every invocation; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

none

env passed through

5 forwarded

HARNESS_COLORHARNESS_NOTTYHARNESS_OPTIONSHARNESS_TIMERHARNESS_VERBOSE

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by kapsl

1 set

PERL_BADLANG

per-subcommand

no overrides

Every invocation gets the same boundary. Where a tool needs more for one subcommand only, kapsl scopes it there rather than granting it everywhere.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗ grype ·
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗ grype ·
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗ grype ·
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗ grype ·
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

1 findings across this project at latest, 6 at 5.40 . Counted once per advisory across every image the project builds.