{"id":"CVE-2026-19487","aliases":["AZL-95756","BELL-CVE-2026-19487","CLSA-2026-1789043015","CLSA-2026-1789204224","DEBIAN-CVE-2026-19487","EUVD-2026-58110","GHSA-cg68-cm33-8vqv","OESA-2026-3930","OESA-2026-3931","OESA-2026-3932","OESA-2026-3933","OESA-2026-4013","UBUNTU-CVE-2026-19487","USN-8736-1","USN-8736-2"],"status":"published","title":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00418,"percentile":0.36466,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-670"],"published":"2026-08-13T15:51:04Z","modified":"2026-11-11T02:47:37Z","fixes":[{"ecosystem":"Azure Linux:3","package":"perl","fixed_in":["5.38.2-516"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl","fixed_in":["5.42.0_rc3-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"perl","fixed_in":["5.42.0_rc3-r0"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl-dev","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl5.26","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-base","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-debug","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-doc","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-modules-5.26","fixed_in":["5.26.1-6ubuntu0.7+tuxcare.els5"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl-dev","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl5.22","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-base","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-debug","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-doc","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-modules-5.22","fixed_in":["5.22.1-9ubuntu0.9+tuxcare.els7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"perl","fixed_in":["5.36.0-7+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"perl","fixed_in":["5.40.1-6+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"perl","fixed_in":["5.42.2-3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl","fixed_in":["5.28.3-17.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl","fixed_in":["5.34.0-20.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl","fixed_in":["5.38.0-18.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl","fixed_in":["5.38.0-18.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"perl","fixed_in":["5.38.0-18.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","fixed_in":["5.18.2-2ubuntu1.7+esm9"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","fixed_in":["5.22.1-9ubuntu0.9+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","fixed_in":["5.26.1-6ubuntu0.7+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","fixed_in":["5.30.0-9ubuntu0.5+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"perl","fixed_in":["5.34.0-3ubuntu1.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"perl","fixed_in":["5.38.2-3.2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"perl","fixed_in":["5.40.1-7ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-516"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.42.0_rc3-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.40.2-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.36.0-r0"},{"fixed":"5.42.0_rc3-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libperl5.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"perl-modules-5.26","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+tuxcare.els5"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libperl5.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"perl-modules-5.22","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+tuxcare.els7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.36.0-7+deb12u4"}]}],"versions":["5.36.0-7","5.36.0-7+deb12u1","5.36.0-7+deb12u2","5.36.0-7+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-6+deb13u1"}]}],"versions":["5.40.1-6"]},{"source":"osv","ecosystem":"Debian:14","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.42.2-3"}]}],"versions":["5.40.1-6","5.40.1-7","5.40.1-8","5.42.0-1","5.42.0-2","5.42.0-3","5.42.2-1","5.42.2-2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.28.3-17.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-20.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-18.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-18.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.0-18.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm9"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm4"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm4"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2","5.26.1-6ubuntu0.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm4"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2","5.30.0-9ubuntu0.5+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.9"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7","5.34.0-3ubuntu1.8"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.6"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3","5.38.2-3.2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.2"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.2-2ubuntu1.7+esm9"}]}],"versions":["5.14.2-21build1","5.18.1-4","5.18.1-4build1","5.18.1-5","5.18.2-2","5.18.2-2ubuntu1","5.18.2-2ubuntu1.1","5.18.2-2ubuntu1.3","5.18.2-2ubuntu1.4","5.18.2-2ubuntu1.6","5.18.2-2ubuntu1.7","5.18.2-2ubuntu1.7+esm3","5.18.2-2ubuntu1.7+esm4","5.18.2-2ubuntu1.7+esm5","5.18.2-2ubuntu1.7+esm7","5.18.2-2ubuntu1.7+esm8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.22.1-9ubuntu0.9+esm4"}]}],"versions":["5.20.2-6","5.22.1-3","5.22.1-4","5.22.1-5","5.22.1-7","5.22.1-8","5.22.1-9","5.22.1-9ubuntu0.2","5.22.1-9ubuntu0.3","5.22.1-9ubuntu0.5","5.22.1-9ubuntu0.6","5.22.1-9ubuntu0.9","5.22.1-9ubuntu0.9+esm1","5.22.1-9ubuntu0.9+esm2","5.22.1-9ubuntu0.9+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.26.1-6ubuntu0.7+esm4"}]}],"versions":["5.26.0-8ubuntu1","5.26.1-2ubuntu1","5.26.1-3","5.26.1-4","5.26.1-4build1","5.26.1-5","5.26.1-6","5.26.1-6ubuntu0.1","5.26.1-6ubuntu0.2","5.26.1-6ubuntu0.3","5.26.1-6ubuntu0.5","5.26.1-6ubuntu0.6","5.26.1-6ubuntu0.7","5.26.1-6ubuntu0.7+esm2","5.26.1-6ubuntu0.7+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.30.0-9ubuntu0.5+esm4"}]}],"versions":["5.28.1-6build1","5.30.0-7","5.30.0-9","5.30.0-9build1","5.30.0-9ubuntu0.2","5.30.0-9ubuntu0.3","5.30.0-9ubuntu0.4","5.30.0-9ubuntu0.5","5.30.0-9ubuntu0.5+esm2","5.30.0-9ubuntu0.5+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.34.0-3ubuntu1.9"}]}],"versions":["5.32.1-3ubuntu3","5.34.0-3ubuntu1","5.34.0-3ubuntu1.1","5.34.0-3ubuntu1.2","5.34.0-3ubuntu1.3","5.34.0-3ubuntu1.4","5.34.0-3ubuntu1.5","5.34.0-3ubuntu1.7","5.34.0-3ubuntu1.8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.40.1-7ubuntu0.2"}]}],"versions":["5.40.1-6build1","5.40.1-7build1","5.40.1-7ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.38.2-3.2ubuntu0.6"}]}],"versions":["5.36.0-9ubuntu1","5.36.0-10ubuntu1","5.38.2-3","5.38.2-3.2","5.38.2-3.2build1","5.38.2-3.2build2","5.38.2-3.2build2.1","5.38.2-3.2ubuntu0.1","5.38.2-3.2ubuntu0.2","5.38.2-3.2ubuntu0.3","5.38.2-3.2ubuntu0.4"],"bundled":2}],"products":[{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ab0)"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp (6es7518-4fx00-1ac0)"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp (6ag1518-4ax00-4ac0)"}],"references":[{"url":"https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","tags":["patch","fix"]},{"url":"https://github.com/Perl/perl5/issues/22892","tags":["issue-tracking","exploit","report"]},{"url":"http://www.openwall.com/lists/oss-security/2026/08/13/8","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cg68-cm33-8vqv"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-19487","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1789043015.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1789204224.html","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19487.json","tags":["advisory"]},{"url":"https://github.com/Perl/perl5","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-19487","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3930","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3931","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3932","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3933","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4013","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-19487","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19487","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/42658992/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8736-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8736-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-15534","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-19487","title":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T15:51:04.09Z","modified":"2026-11-10T12:40:57.549Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"adp"}],"cwes":["CWE-670"],"updated_at":"2026-11-10T13:38:44.039016Z"}],"euvd":[{"id":"EUVD-2026-58110","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T15:51:04Z","modified":"2026-11-10T12:40:57Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-10T14:21:11.690542Z"}],"ghsa":[{"id":"GHSA-cg68-cm33-8vqv","title":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a...","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T18:31:37Z","modified":"2026-11-10T15:33:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-670"],"updated_at":"2026-11-10T15:55:02.881893Z"}],"nvd":[{"id":"CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T16:17:59.44Z","modified":"2026-11-10T13:18:30.413Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-670"],"updated_at":"2026-11-10T16:19:47.780097Z"}],"osv":[{"id":"BELL-CVE-2026-19487","status":"published","published":"2026-08-18T06:06:10.188969Z","modified":"2026-08-21T07:15:31.773529726Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"CVE-2026-19487","title":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T15:51:04.09Z","modified":"2026-11-11T02:47:37.748360518Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-670"],"updated_at":"2026-11-11T03:22:28.447808Z"},{"id":"DEBIAN-CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.  The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.  Example:    \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE   \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed  An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T16:17:59.44Z","modified":"2026-10-05T21:00:06.776995341Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:53.097669Z"},{"id":"OESA-2026-3930","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.(CVE-2026-19487)","status":"published","published":"2026-09-20T13:23:19Z","modified":"2026-09-20T13:30:26.975566916Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3931","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.(CVE-2026-19487)","status":"published","published":"2026-09-20T13:23:20Z","modified":"2026-09-20T13:30:26.971792121Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3932","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.(CVE-2026-19487)","status":"published","published":"2026-09-20T13:23:21Z","modified":"2026-09-20T13:30:26.976888494Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-3933","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.(CVE-2026-19487)","status":"published","published":"2026-09-20T13:23:21Z","modified":"2026-09-20T13:30:25.627014595Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"OESA-2026-4013","title":"perl security update","description":"Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nPerl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \u0026quot;ABCDE\u0026quot; =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.(CVE-2026-19487)","status":"published","published":"2026-09-25T01:27:13Z","modified":"2026-09-25T01:45:07.401344151Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example:   \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE   \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T16:17:00Z","modified":"2026-09-17T02:56:42.306623485Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T16:56:01.334185Z"},{"id":"AZL-95756","title":"CVE-2026-19487 affecting package perl for versions less than 5.38.2-516","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.","status":"published","published":"2026-08-13T16:17:59Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"CLSA-2026-1789043015","title":"Fix CVE(s): CVE-2026-19487","description":"   * SECURITY UPDATE: incorrect regular expression match when the Aho-Corasick\n     prescan resumes after following a fail link\n     - debian/patches/CVE-2026-19487.patch: reset the \"failed\" flag on a\n       successful trie transition in S_find_byclass() in regexec.c, and add the\n       upstream regression tests to t/re/re_tests\n     - CVE-2026-19487","status":"published","published":"2026-09-10T12:23:45Z","modified":"2026-10-26T09:32:04.274946707Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789204224","title":"Fix CVE(s): CVE-2026-19487","description":"   * SECURITY UPDATE: incorrect regex match in Aho-Corasick prescan (GH#22892)\n     - debian/patches/fixes/CVE-2026-19487.patch: reset the stale failed flag\n       after a successful trie transition in the AHOCORASICK arm of\n       S_find_byclass() in regexec.c, so the prescan is no longer aborted on a\n       worse or non-matching alternative; adds the upstream regression vectors\n       to t/re/re_tests\n     - CVE-2026-19487","status":"published","published":"2026-09-12T09:10:35Z","modified":"2026-10-26T09:32:02.423895251Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"USN-8736-1","title":"perl vulnerabilities","description":"It was discovered that Perl incorrectly handled certain large inputs during\nregular expression matching. An attacker could possibly use this issue to\ntrigger out-of-bounds heap reads or writes, resulting in a denial of\nservice or arbitrary code execution. (CVE-2026-15534)\n\nIt was discovered that Perl incorrectly handled certain regular expression\ncontaining alternative matching branches. An attacker could  possibly use\nthis issue to cause incorrect regular expression matches, resulting in\nsecurity restrictions being bypassed. (CVE-2026-19487)","status":"published","published":"2026-09-08T14:25:07Z","modified":"2026-09-09T00:42:26.220114024Z","updated_at":"2026-11-02T16:58:26.907654Z"},{"id":"USN-8736-2","title":"perl vulnerabilities","description":"USN-8736-1 fixed vulnerabilities in Perl. This update provides the\ncorresponding fix for Perl on Ubuntu 24.04 LTS.\n\nOriginal advisory details:\n\nIt was discovered that Perl incorrectly handled certain large inputs during\nregular expression matching. An attacker could possibly use this issue to\ntrigger out-of-bounds heap reads or writes, resulting in a denial of\nservice or arbitrary code execution. (CVE-2026-15534)\n\nIt was discovered that Perl incorrectly handled certain regular expression\ncontaining alternative matching branches. An attacker could  possibly use\nthis issue to cause incorrect regular expression matches, resulting in\nsecurity restrictions being bypassed. (CVE-2026-19487)","status":"published","published":"2026-09-16T14:37:44Z","modified":"2026-09-17T02:57:28.244466132Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}