https://bugzilla.redhat.com/show_bug.cgi?id=2529177
Bug ID: 2529177
Summary: CVE-2026-19487 perl: Perl: Incorrect regular
expression matching can lead to wrong access or
filtering decisions. [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["8ce72ce3-744a-4c2b-8940-03fdcd1c4955"]}
Component: perl
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected], [email protected],
[email protected], [email protected]
Blocks: 2515438 (CVE-2026-19487)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression
match results when a stale failure flag ends the Aho-Corasick prescan early in
S_find_byclass.
The prescan walks the subject for positions where the full pattern could match,
and the engine tries it from the leftmost one recorded. A failing transition
sets the failed flag, and a later successful transition does not clear it, so
the prescan reads the stale flag as a failure and stops before it can record a
candidate that starts earlier. It takes a subject where one candidate is
recorded and a later character then forces a fallback through a fail link that
succeeds.
Example:
"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE
"ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed
An alternation like this can miss input it should match, or match it on the
wrong branch, so an access or filtering decision made from the result can be
wrong.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2515438
[Bug 2515438] CVE-2026-19487 perl: Perl: Incorrect regular expression matching
can lead to wrong access or filtering decisions.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2529177
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202529177%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
