CVE-2026-112921

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-112921
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112921.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-112921
Published
2026-10-21T21:37:54Z
Modified
2026-11-01T02:30:31Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request
Details

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.

Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails.

A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated.

Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-488"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112921.json"
}
References

Affected packages

Git / github.com/robrwo/robots-validate

Affected ranges

Type
GIT
Repo
https://github.com/robrwo/robots-validate
Events
Introduced
8b1875245502ccb2e7c06ed4f2ddd1a511893958
Fixed
776a1456e6605492b7582ed25d3d5006ef384402
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0.4.3"
                },
                {
                    "fixed": "0.4.10"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "776a1456e6605492b7582ed25d3d5006ef384402"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "introduced": "0.4.3"
                },
                {
                    "fixed": "0.4.10"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

Affected versions

v0.*
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112921.json"