CPAN Security Group

A forum for coordinating and help resolving security issues on CPAN. CVE Numbering Authority (CNA) for Perl and CPAN. Subscribe, contribute or join!

CPAN Security Group

Welcome to the CPAN Security Group. This is a community effort for supporting and responding to security incidents on CPAN – the Comprehensive Perl Archive Network.

This group also cares about security-related topics around CPAN distributions, the CPAN/PAUSE infrastructure, and about tooling and the ecosystem in general. Over time, we aim to improve supply chain security, make CPAN a more secure and trustworthy publishing platform, and more.

CPANSec is the CVE Numbering Authority (CNA) for CPAN and Perl.

Learn more & Contribute

On CPAN, improving security is a volunteer-driven collaborative effort. If you care and would like to make a contribution, you can…

Explore our main website
Check us out on Github
Join us in our Matrix channel, #cpansec-discussion on matrix.org
Join us in our IRC channel, #cpan-security on irc.perl.org
Send an e-mail to the CPAN Security Group <cpan-security@security.metacpan.org> 📧
Subscribe to @cpansec@fosstodon.org on the Fediverse 🐘
Subscribe to the CPANSec mailing lists
Browse and read the CPANSec CVE Announcements archive

Resources

Security and incident policies
- How to Report a Security Issue
- The CPANSec CNA Disclosure Policy
- The CPANSec Contributor Pre-Release Disclosure Agreement
Important Documents and other relevant resources
- Group charter ⚠️ DRAFT
- Standards and regulations reading list ⚠️ DRAFT
- Guides
- Consultations
Projects overview on Github
Meetings information and minutes
Presentations about us and our work

Recent news

Security Reports for CPAN Authors

July 3, 2026 less than 1 minute read Robert Rothenberg

We have added a new guide on Security Reports for CPAN Authors.

CPANSec CNA and CVE FAQ

June 21, 2026 less than 1 minute read Robert Rothenberg

We have added a CPANSec CNA and CVE Frequently Asked Questions (FAQ).

CNA Vulnerability to Fix and Disclosure Workflow

April 28, 2026 less than 1 minute read Robert Rothenberg

We have added the CNA Vulnerability to Fix and Disclosure Workflow that describes our process from receiving vulnerability reports to vulnerability publishing.