CVE-2026-19487: 
Wolfi vulnerability analysis and mitigation

CVE-2026-19487 is a regex engine logic flaw in Perl that causes incorrect regular expression match results due to a stale failure flag in the Aho-Corasick prescan within S_find_byclass. It affects Perl versions from 5.9.4 (introduced with the trie optimization in Perl 5.10) through 5.41.8, with 5.41.9 and later being unaffected. The vulnerability was publicly disclosed on August 13, 2026, and assigned by CPANSec. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, oss-security).

The root cause is classified as CWE-670 (Always-Incorrect Control Flow Implementation). In Perl's S_find_byclass function within regexec.c, the Aho-Corasick prescan uses a failed flag to track failed state transitions. When a transition fails, the flag is set; however, when a subsequent transition succeeds, the flag is never cleared. This causes the prescan to prematurely terminate, missing valid candidate match positions that start earlier in the subject string. The result is that alternation patterns can match the wrong branch or fail to match entirely — for example, "ABCDE" =~ m/ABCF|BCDE|C/ incorrectly matches C at offset 2 instead of BCDE. The fix is a single-line addition (failed = 0;) after a successful transition in regexec.c (Perl patch, Perl issue #22892).

The primary security consequence is that access control or input filtering logic implemented using Perl regex alternations may produce incorrect decisions — either failing to match input that should be blocked, or matching on the wrong branch. An unauthenticated network attacker can craft input that exploits this flaw to bypass security filters, input validators, or access controls that rely on pattern matching. The CVSS assessment reflects a low availability impact (incorrect match results can cause logic failures), with no direct confidentiality or integrity impact at the engine level, though application-level integrity is at risk if security decisions are based on flawed regex results (Github Advisory, oss-security).

No public proof-of-concept exploit or evidence of in-the-wild exploitation has been reported as of the disclosure date. The NVD SSVC assessment notes the vulnerability is automatable (no user interaction required) and has a partial technical impact. The EPSS score is 0.0, indicating very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Github Advisory, oss-security).

1. Identify target application: Locate a Perl-based application (running Perl 5.9.4–5.41.8) that uses regex alternation patterns for security-critical decisions such as input validation, access control, or content filtering.
2. Analyze the regex pattern: Determine the specific alternation pattern used by the application. The vulnerability is triggered when the pattern has two alternatives where one alternative's proper prefix matches a proper suffix of another, and one alternative is shorter (e.g., m/ABCF|BCDE|C/).
3. Craft bypass input: Construct input that should match a longer, more restrictive branch of the alternation but instead causes the prescan to match a shorter, less restrictive branch — or causes no match at all, bypassing a blocklist check.
4. Submit crafted input: Send the crafted input to the application via the network (e.g., HTTP request, form field, API parameter) without requiring authentication.
5. Achieve bypass: The flawed prescan causes the regex to return an incorrect result, causing the application's security decision (e.g., allow/deny, filter/pass) to be made incorrectly, potentially granting unauthorized access or bypassing a content filter (Perl patch, Perl issue #22892).

The recommended remediation is to upgrade Perl to version 5.41.9 or later (or Perl 5.42.0 stable when available), which includes the one-line fix resetting the failed flag after a successful Aho-Corasick transition. For environments that cannot upgrade immediately, the upstream patch can be applied directly to regexec.c. As an interim measure, security-critical regex patterns used for access control or input validation should be reviewed and tested against the known edge-case inputs, and additional non-regex validation layers should be considered for critical security decisions (oss-security, Perl patch).

The vulnerability was originally reported by user mauke on the Perl GitHub issue tracker in January 2025, referencing an initial discovery and public discussion by jwz on his blog. The bug was noted to have existed undetected for over a decade since the trie optimization was introduced in Perl 5.10. The fix was authored by Yves Orton and the CVE was formally assigned and disclosed by the CPAN Security Group (CPANSec) in August 2026. Community discussion appeared on oss-security and Bluesky (Perl issue #22892, oss-security).