CVE-2026-19487

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19487
Downstream
Published
2026-08-13T15:51:04.090Z
Modified
2026-08-15T16:52:27.715972Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass
Details

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass.

The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.

Example:

"ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed

An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

Database specific 
{
    "cwe_ids": [
        "CWE-670"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19487.json",
    "cna_assigner": "CPANSec"
}
References

Affected packages

Git / github.com/perl/perl5

Affected ranges

Type
GIT
Repo
https://github.com/perl/perl5
Events
Introduced
27e0a6173cfa04e70f8057a8b3a0ceb668a33dbc
Fixed
b6969eb9f23724dcbb888d791d31c4708dabc85c
Fixed
1a21abacaf6f684928bae8baaa153733c8c238eb
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "5.9.4"
        },
        {
            "fixed": "5.41.9"
        }
    ]
}

Affected versions

Other
GitLive-blead
if-0.*
if-0.0603
if-0.0604
if-0.0605
perl-5.*
perl-5.9.4
perl-5.9.5
v5.*
v5.10.0
v5.11.0
v5.11.1
v5.11.3
v5.11.4
v5.11.5
v5.12.0
v5.12.0-RC0
v5.12.0-RC1
v5.12.0-RC2
v5.12.0-RC3
v5.12.0-RC4
v5.12.0-RC5
v5.13.0
v5.13.1
v5.13.10
v5.13.11
v5.13.2
v5.13.3
v5.13.4
v5.13.5
v5.13.6
v5.13.7
v5.13.8
v5.13.9
v5.14.0
v5.14.0-RC1
v5.14.0-RC2
v5.14.0-RC3
v5.15.0
v5.15.1
v5.15.2
v5.15.3
v5.15.4
v5.15.5
v5.15.9
v5.16.0
v5.16.0-RC1
v5.16.0-RC2
v5.17.0
v5.17.2
v5.17.4
v5.17.6
v5.17.7
v5.17.7.0
v5.17.8
v5.17.9
v5.18.0
v5.18.0-RC1
v5.18.0-RC2
v5.18.0-RC3
v5.18.0-RC4
v5.19.0
v5.19.1
v5.19.11
v5.19.2
v5.19.3
v5.19.5
v5.19.7
v5.20.0
v5.20.0-RC1
v5.21.0
v5.21.1
v5.21.10
v5.21.11
v5.21.4
v5.21.5
v5.21.6
v5.21.8
v5.21.9
v5.22.0
v5.22.0-RC1
v5.22.0-RC2
v5.23.0
v5.23.1
v5.23.2
v5.23.3
v5.23.4
v5.23.6
v5.23.7
v5.24.0
v5.24.0-RC1
v5.24.0-RC2
v5.24.0-RC3
v5.24.0-RC4
v5.24.0-RC5
v5.25.0
v5.25.11
v5.25.2
v5.25.3
v5.25.4
v5.25.5
v5.25.7
v5.25.9
v5.26.0
v5.26.0-RC2
v5.27.0
v5.27.10
v5.27.11
v5.27.3
v5.27.5
v5.27.6
v5.27.7
v5.27.8
v5.28.0
v5.28.0-RC1
v5.28.0-RC2
v5.28.0-RC3
v5.28.0-RC4
v5.29.0
v5.29.1
v5.29.10
v5.29.5
v5.29.6
v5.29.7
v5.29.8
v5.29.9
v5.30.0
v5.30.0-RC1
v5.30.0-RC2
v5.31.0
v5.31.1
v5.31.11
v5.31.2
v5.31.3
v5.31.4
v5.31.5
v5.31.7
v5.32.0
v5.32.0-RC1
v5.33.0
v5.33.1
v5.33.2
v5.33.3
v5.33.4
v5.33.7
v5.33.8
v5.33.9
v5.34.0
v5.34.0-RC1
v5.34.0-RC2
v5.35.0
v5.35.10
v5.35.11
v5.35.3
v5.35.5
v5.35.6
v5.35.8
v5.35.9
v5.36.0
v5.36.0-RC3
v5.37.0
v5.37.1
v5.37.10
v5.37.11
v5.37.2
v5.37.3
v5.37.4
v5.37.5
v5.37.6
v5.37.7
v5.37.9
v5.38.0
v5.38.0-RC1
v5.38.0-RC2
v5.39.0
v5.39.1
v5.39.3
v5.39.4
v5.39.5
v5.39.7
v5.39.8
v5.40.0
v5.40.0-RC1
v5.40.0-RC2
v5.41.0
v5.41.1
v5.41.2
v5.41.3
v5.41.4
v5.41.5
v5.41.7
v5.41.8

Database specific

vanir_signatures_modified 
"2026-08-15T16:52:27Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19487.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "target": {
            "file": "regexec.c"
        },
        "id": "CVE-2026-19487-4b106e08",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "55769216002795494645515032186904241398",
                "113212024098219993903444201705675266761",
                "215819105125352024112542694866755516687",
                "212854781174257346530163907631184059232"
            ]
        },
        "source": "https://github.com/perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb",
        "signature_type": "Line"
    },
    {
        "deprecated": false,
        "target": {
            "file": "regexec.c",
            "function": "S_find_byclass"
        },
        "id": "CVE-2026-19487-9566fc54",
        "signature_version": "v1",
        "digest": {
            "function_hash": "36656232328103073434296667040227248551",
            "length": 21163.0
        },
        "source": "https://github.com/perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb",
        "signature_type": "Function"
    }
]