https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 21:45:38 +0000 https://cve.radiocsirt.org/vuln/cve-2026-19487 <p><strong>Affected:</strong> perl</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> <p><strong>Affected:</strong> perl</p> <p>Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.</p> <p>The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.</p> <p>Example:</p> <p>&#34;ABCDE&#34; =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE &#34;ABCDE&#34; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed</p> <p>An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.</p> https://cve.radiocsirt.org/vuln/cve-2026-19487