CVE-2026-19487: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-19487 is a regex engine logic flaw in Perl affecting versions from 5.9.4 before 5.41.9, where a stale failure flag in the Aho-Corasick prescan within S_find_byclass causes incorrect regular expression match results. The bug was introduced with the trie optimization in Perl 5.10 and went undetected for over a decade before being reported in January 2025 and publicly disclosed on August 13, 2026. It affects all Perl installations in the version range, including Microsoft's Azure Linux 3 package azl3_perl_5.38.2-514. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, oss-security).

The root cause is classified as CWE-670 (Always-Incorrect Control Flow Implementation): in regexec.c, the S_find_byclass function's Aho-Corasick prescan sets a failed flag on a failing state transition but never clears it upon a subsequent successful transition. As a result, the prescan terminates prematurely, failing to record earlier candidate match positions, and the regex engine either matches the wrong alternation branch or misses a valid match entirely. The fix is a single-line addition (failed = 0;) after a successful transition in the state machine loop (Perl Patch, Perl Issue). The vulnerability is exploitable remotely with no privileges or user interaction required, provided the attacker can supply input to a Perl application that uses multi-alternation regex patterns for security decisions.

The primary impact is an authentication bypass or security filter evasion: an unauthenticated network attacker can craft input strings that cause Perl's regex engine to produce incorrect match results, causing access control or input validation logic based on regex alternations to make wrong decisions — either allowing input that should be blocked or blocking input that should be allowed. Confidentiality and integrity are not directly impacted at the engine level, but downstream application logic relying on flawed match results may expose sensitive resources or permit unauthorized actions. The availability impact is rated Low, as incorrect match results can disrupt application behavior without causing a crash (Github Advisory, oss-security).

The NVD SSVC assessment classifies this vulnerability as automatable with a PoC exploitation status, though no public proof-of-concept exploit code or active in-the-wild exploitation has been confirmed as of the disclosure date (Github Advisory). The EPSS score is approximately 0.43%, placing it in the 35th percentile for exploitation likelihood within 30 days. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The bug is exploitable without authentication or user interaction over the network, but requires the target application to use specific multi-alternation regex patterns in security-critical code paths.

1. Reconnaissance: Identify Perl-based web applications or services (versions 5.9.4–5.41.8) that use regex alternations for input validation, authentication, or access control — e.g., URL routing, allowlist/blocklist filtering, or login checks.
2. Pattern analysis: Analyze the target application's regex patterns (via source code review, error messages, or behavioral probing) to identify alternations where one branch is a proper prefix/suffix of another, triggering the Aho-Corasick prescan bug.
3. Craft malicious input: Construct an input string that should match a longer, more restrictive alternation branch (e.g., a blocked pattern) but instead causes the regex to match a shorter, less restrictive branch — or to produce no match at all — due to the stale failed flag. For example, if a filter blocks BCDE via m/ABCF|BCDE|C/, the engine may match only C instead, bypassing the intended block.
4. Submit crafted input: Send the crafted input to the vulnerable application endpoint (e.g., via HTTP request parameters, form fields, or API calls).
5. Achieve bypass: The incorrect regex result causes the application's security decision to be wrong — granting access, bypassing a filter, or matching the wrong branch — allowing the attacker to reach restricted functionality or inject disallowed content (Perl Issue, oss-security).

The recommended remediation is to upgrade Perl to version 5.41.9 or later (or Perl 5.42.0 stable), which includes the one-line fix resetting the failed flag after a successful Aho-Corasick state transition (oss-security). The upstream patch can be applied manually to affected versions: Perl Patch. As a workaround for applications that cannot be immediately patched, review and restructure security-critical regex patterns to avoid multi-alternation constructs where one branch is a prefix/suffix of another, and add independent validation layers not relying solely on regex matching for access control decisions.

The vulnerability was originally reported as a bug by user mauke on the Perl GitHub issue tracker in January 2025, referencing an initial public discussion by jwz on his blog (Perl Issue). The CPAN Security Group (CPANSec) assigned the CVE and coordinated disclosure via the oss-security mailing list in August 2026 (oss-security). Community reaction noted the bug's longevity — present since Perl 5.10's trie optimization introduction over a decade ago — with some surprise that such a subtle logic error in a widely-used language's regex engine went undetected for so long.