Regular Expression Match Flaw in Perl Affects String Pattern Matching
CVE-2026-19487

Currently unrated

Key Information:

Status
Vendor
CVE Published:
13 August 2026

What is CVE-2026-19487?

A flaw in Perl's handling of regular expressions can lead to incorrect match results due to a stale failure flag affecting the Aho-Corasick prescan mechanism. This issue may cause certain input strings to be improperly matched or missed entirely, leading to potential misinterpretations in access or filtering decisions. An attacker could exploit this inconsistency to cause unintended behavior in applications relying on Perl for string handling.

References

https://github.com/Perl/perl5/commit/1a21abacaf6f684928ba...
patch
https://github.com/Perl/perl5/issues/22892
issue-tracking

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.