01 Record

CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass

MediumPUBLISHEDCNA: CPANSec

Base score5.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

View raw JSON CVE Program record

02 Description

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass

03 Metadata

Published: 2026-08-13 15:51Z1 DAY AGO
Last updated: 2026-08-13 20:12Z22 HR AGO
Reserved: 2026-08-10
Assigning CNA: CPANSec
Record state: PUBLISHED
Severity: Medium (CVSS 5.3)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-670
SSVC decision: ExploitationpocAutomatableyesTechnical Impactpartial
Data version: 5.2
Document digest: 864622ea93e63ab72d8b8a677251b9682b027e75fe55bf9ef535abc59c9ee37c

04 Affected products

No products listed

This record names no affected vendor or product. That is common for reserved identifiers and for records whose CNA published only a narrative description.

05 References

github.comhttps://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patchpatch
github.comhttps://github.com/Perl/perl5/issues/22892issue-tracking
www.openwall.comhttp://www.openwall.com/lists/oss-security/2026/08/13/8

CVE-2026-19487

02 Description

03 Metadata

04 Affected products

05 References

06 Remediation

02 Description

03 Metadata

04 Affected products

05 References

CVE-2026-19487

02 Description

03 Metadata

04 Affected products

05 References

06 Remediation