The Perl development team has announced the release of Perl 5.44, the first stable production version in the new 5.44 series, which follows about 12 months of development since Perl 5.42.
The most notable language addition is experimental support for named parameters in subroutine signatures. Until now, arguments in Perl signatures were primarily passed according to their position. Perl 5.44 allows developers to define selected parameters that callers can supply using name-and-value pairs.
For example:
sub create_user ($name, :$email, :$active = 1) {
...
}
create_user("John", email => "john@example.com");Code language: Perl (perl)Perl 5.44 also combines two experimental features: multi-variable foreach loops and reference aliases. Developers can now process multiple values per loop iteration and declare variables as aliases to referenced data.
This allows a loop to iterate over key and array reference pairs while directly aliasing the array:
foreach my ($key, \@items) (%hash) {
say "The $key array contains: @items";
}Code language: Perl (perl)Both the refaliasing and declared_refs features required by this syntax remain experimental.
Moreover, regular expression handling with the /xx modifier has been expanded. With the experimental enhanced_xx feature enabled, bracketed character classes can span multiple lines and include comments. Perl can also warn when part of a pattern may have been unintentionally interpreted as a comment.
At the same time, Perl 5.44 introduces new restrictions for /xx expressions. Using an unescaped # character or literal vertical whitespace inside a bracketed character class is now deprecated. Existing expressions continue to work for the moment, but they generate deprecation warnings and should be updated by escaping the # character or using sequences such as \n.
Another important update is support for Unicode 17.0. Perl now enforces Unicode rules more strictly for identifiers and named regular expression groups. About 160 characters previously accepted through Perl’s broader \w interpretation are now rejected because they do not comply with Unicode’s XID_Start and XID_Continue properties.
Because this is an incompatible change, developers using uncommon Unicode characters in variable, package, function, or regular expression group names should review their code before upgrading.
On the security side, this release addresses three vulnerabilities. CVE-2026-8376 involves an incorrect buffer-size calculation in Perl_study_chunk that could cause an integer overflow and out-of-bounds writes on 32-bit systems.
CVE-2026-57432 affects handling of very large structures passed to pack or unpack. A large repeat count could cause an integer overflow and subsequent buffer overflow.
The third issue, CVE-2026-13221, affects the regular expression engine’s trie optimization. Expressions with more than about 65,000 alternative branches could overflow a 16-bit field, potentially causing incorrect matches.
Perl 5.44 also changes how its internal pseudorandom number generator is seeded. On supported Linux, BSD, and macOS systems, Perl now uses the getentropy() system call first, then falls back to /dev/urandom, and finally to a hash of internal state if needed.
However, the project stresses that Perl’s internal rand implementation is still unsuitable for cryptographic or other security-sensitive applications.
Regarding performance, several common operations are slightly faster in this release, including non-overflowing integer addition, subtraction, and multiplication on systems with appropriate compiler support.
Additionally, hash creation from lists of compile-time constant string keys has been optimized. Signature processing at the start of subroutines now incurs less runtime overhead.
Last but not least, a long-standing deprecated behavior has now been removed. Using goto to jump from outside a loop or block directly into its body, deprecated since Perl 5.12, is no longer permitted.
For additional details, see the announcement or review all the changes here.
With Perl 5.44 now available, support for the Perl 5.40 branch has officially ended. The developers expect Perl 5.45.1, the first development release for the next stable branch, in the coming weeks. The next major stable Perl release is planned for the first half of 2027.
