https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:05:50 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-19487 <p><strong>Affected:</strong> Alpaquita:23: perl, Alpaquita:25: perl, Alpaquita:stream: perl, BellSoft Hardened Containers:23: perl, BellSoft Hardened Containers:25: perl, BellSoft Hardened Containers:stream: perl</p> <p><strong>Affected:</strong> Alpaquita:23: perl, Alpaquita:25: perl, Alpaquita:stream: perl, BellSoft Hardened Containers:23: perl, BellSoft Hardened Containers:25: perl, BellSoft Hardened Containers:stream: perl</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-19487 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/euvd-2026-352319 EUVD-2026-352319 https://cve.radiocsirt.org/vuln/euvd-2026-352319 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19487 <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-19487 https://cve.radiocsirt.org/vuln/ghsa-cg68-cm33-8vqv <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> https://cve.radiocsirt.org/vuln/ghsa-cg68-cm33-8vqv https://cve.radiocsirt.org/vuln/msrc_cve-2026-19487 msrc_CVE-2026-19487 https://cve.radiocsirt.org/vuln/msrc_cve-2026-19487 https://cve.radiocsirt.org/vuln/oesa-2026-3930 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: perl</p> <p>Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fix(es):</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&amp;quot;ABCDE&amp;quot; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &amp;quot;ABCDE&amp;quot; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.(CVE-2026-19487)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP4: perl</p> <p>Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fix(es):</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&amp;quot;ABCDE&amp;quot; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &amp;quot;ABCDE&amp;quot; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.(CVE-2026-19487)</p> https://cve.radiocsirt.org/vuln/oesa-2026-3930 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-19487 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:26.04:LTS: perl</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: &#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: perl, Ubuntu:Pro:16.04:LTS: perl, Ubuntu:Pro:18.04:LTS: perl, Ubuntu:Pro:20.04:LTS: perl, Ubuntu:22.04:LTS: perl, Ubuntu:24.04:LTS: perl, Ubuntu:26.04:LTS: perl</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: &#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-19487 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2847 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Perl ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Perl ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2847