Robots::Validate Vulnerability in Perl Report Clients by RRWO
CVE-2026-112921

Currently unrated

Key Information:

Status
Vendor
CVE Published:
21 October 2026

What is CVE-2026-112921?

The Robots::Validate module for Perl report clients contains a flaw that enables remote clients to impersonate legitimate robots by leveraging incomplete User-Agent strings. This occurs because the Aho-Corasick search machine does not reset its state between requests, allowing a User-Agent that partially matches a robot name to affect subsequent User-Agent validations. When the next User-Agent checked completes the robot name, it can lead to the unintended blocking of legitimate visitors based on DNS rules intended for bot protection. This vulnerability affects versions 0.4.3 through 0.4.10, including those using Algorithm::AhoCorasick::XS.

References

https://github.com/robrwo/Robots-Validate/commit/776a1456...
patch
https://metacpan.org/release/RRWO/Robots-Validate-v0.4.10...
release-notes
https://metacpan.org/release/RRWO/Robots-Validate-v0.4.11...
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.