Description

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-13T16:17:59.440Z",
  "pubdate": "2026-08-13T16:17:59.440Z",
  "executiveSummary": "A logic vulnerability exists in Perl versions from 5.9.4 before 5.41.9 regarding regular expression matching processing.\nThe vulnerability arises from an incorrect regular expression match result caused by a stale failure flag terminating the Aho-Corasick prescan prematurely within the S_find_byclass function.\nThis flaw impacts Perl systems parsing specific regular expression alternations, potentially leading to incorrect access control or filtering decisions due to missed pattern matches or matches on incorrect branches.\nThe attacker capabilities involve supplying carefully crafted input strings evaluated against specific regular expression patterns containing alternations.\nNo authentication or specific privileges are required for exploitation beyond triggering the evaluation of vulnerable regular expression patterns against malicious or malformed subject data.\nRisk implications include security bypasses where downstream logic relies on regex-based input filtering, authentication checks, or data validation mechanisms that fail to process inputs correctly.",
  "technicalDetails": "The vulnerable component is the regular expression engine in Perl, specifically within the S_find_byclass function responsible for executing the Aho-Corasick prescan.\nAffected software versions include Perl from version 5.9.4 up to, but not including, version 5.41.9.\nThe root cause of the vulnerability is improper state management during the Aho-Corasick prescan optimization phase. The prescan walks the subject string searching for candidate positions where the full pattern could match, recording the leftmost position.\nDuring this traversal, a failing transition sets a failure flag. However, a subsequent successful transition fails to clear this stale failure flag.\nAs a result, the prescan reads the stale flag as a current failure condition and terminates early, failing to record a candidate that starts earlier in the subject string.\nThis occurs when a subject string contains an initial candidate that is recorded, followed by a later character that forces a fallback through a fail link that ultimately succeeds.\nFor example, evaluating the subject string \"ABCDE\" against the regular expression m/ABCF|BCDE|C/ results in matching C at offset 2 instead of the expected BCDE branch. Similarly, evaluating \"ABCDE\" against m/ABCF|BCDE|C(G)/ results in no match, entirely missing the BCDE branch.\nThe attack flow requires an application to process untrusted input against vulnerable regular expression patterns featuring specific alternations.\nBy supplying targeted input data designed to trigger the stale failure flag state, an attacker can cause the regex engine to miss input it should normally match or evaluate the match against the wrong branch.\nPost-exploitation impact depends heavily on the application context, where flawed matching results can corrupt access control evaluations, validation checks, or security filtering decisions."
}