CVE-2026-19487

Executive Summary

CVE-2026-19487 is a logic flaw in the Perl regular expression engine affecting Perl versions from 5.9.4 up to (but not including) 5.41.9. A stale failure flag in the Aho-Corasick prescan inside S_find_byclass can terminate the prescan early, causing the regex engine to produce incorrect match results — either missing a substring that should have matched or matching the wrong alternation branch. Because Perl regexes are frequently used for input validation, content filtering, and access-control decisions, this flaw can cause security-critical filtering and access decisions to be made on incorrect match data. The vulnerability is remotely triggerable without authentication, has low attack complexity, and currently has no public PoC, no CISA KEV listing, and low exploit-probability scoring (EPSS 0.00434).

Technical Analysis

The defect is located in Perl's internal regex execution path, specifically in the subroutine S_find_byclass, which is used during the engine's fast-scan (prescan) phase. When an alternation pattern is compiled, parts of it can be analyzed as an Aho-Corasick automaton. This automaton walks the subject string looking for positions where a full pattern match could occur, recording the leftmost candidate position it finds, after which the engine attempts a full match from that location.

The NVD description identifies the precise control-flow error: during the prescan, a failing automaton transition sets a "failed" flag. A later successful transition does not clear this flag. As a result, when the prescan encounters a later character that forces a fallback through a fail link that ultimately succeeds, the prescan reads the stale failed flag and stops prematurely — before it has had a chance to record a candidate match that starts at an earlier offset. The condition is triggered by a subject string in which one candidate is recorded, and a subsequent character forces the automaton to fall back through a failure transition that succeeds.

Two concrete triggering examples are provided in the NVD description:

• "ABCDE" =~ m/ABCF|BCDE|C/ — this incorrectly matches "C" at offset 2 instead of matching "BCDE".
• "ABCDE" =~ m/ABCF|BCDE|C(G)/ — this produces no match at all, even though "BCDE" should match.

The root cause corresponds to CWE-670, Always-Incorrect Control Flow Implementation: the failure flag is state that should be reset or re-evaluated at each transition, but is not, so the control flow of the prescan diverges from the intended algorithm. The impact is a correctness bug — not a memory-corruption issue — but the security relevance comes from the fact that Perl applications routinely derive authorization, filtering, and routing decisions from regex match results. A regex that behaves differently from its logical specification can let input through a blocklist, cause the wrong validation branch to be taken, or produce a false negative that silently drops or misclassifies data.

The attack surface is any application or service running a vulnerable Perl interpreter and applying alternation-based regular expressions to attacker-controlled data. This includes CGI scripts, mail filters, proxy/anti-spam tooling written in Perl, log parsers, API validation layers, and content-management systems with Perl backends. Because the flaw is at the engine level, any regex containing multiple alternation branches with overlapping or fallback-prone prefixes may be affected; the exact automaton layout and subject-string content determine whether the bug manifests.

No vendor advisory has been issued publicly for the product, and the OSV entry for the advisory (package 27e0a6173cfa04e70f8057a8b3a0ceb668a33dbc) lists the state as "unfixed," which is consistent with the 2/4 patch-confidence rating. The NVD version range indicates that 5.41.9 is the first release in which the behavior is corrected, but this has not been independently confirmed against a second source.

Exploitation Scenarios

No public PoC or exploit code is currently documented (status: UNKNOWN per CVE data, with "Exploit Code: NO" and "Nuclei Template: NO"). The following attack chain is therefore inferred from the vulnerability class and the mechanics described in the NVD entry; do not treat the concrete trigger details as a weaponized payload.

1. Reconnaissance / target identification. An attacker identifies a service or application whose backend is Perl and which applies alternation-based regular expressions to untrusted input. Likely targets include web applications using Perl regexes for parameter validation, email/content filtering gateways, URL rewrit ing or allowlist/blocklist checks, and API endpoints that classify or tag user-supplied text. From an external vantage point, the attacker probes with benign inputs designed to expose regex misbehavior (e.g., strings with multiple overlapping substring candidates), or studies the application's response behavior to infer the underlying pattern structure.

2. Triggering the flaw class. The attacker crafts a subject string that satisfies the automaton condition described in the NVD: at least one candidate match position must be recorded by the prescan, and a later character in the subject must force the automaton to traverse a fail link that then succeeds. In the NVD examples, "ABCDE" plays this role against the alternations m/ABCF|BCDE|C/ and m/ABCF|BCDE|C(G)/. The attacker repeats the pattern: the string begins with a prefix that lets one branch record a candidate, then continues with characters that revisit an earlier automaton state via a failure transition, leaving the stale failed flag set. The result is either a false negative (no match reported) or a match on the wrong alternation branch.

3. Payload / execution method. The crafted input is submitted through the application's normal interface — an HTTP request parameter, an email header/body, a file upload, or a chat/form input. No memory corruption, shell access, or code injection is involved; the exploit is entirely data-driven and executes through the ordinary regex evaluation performed on the input. Because the vulnerable code path runs inside S_find_byclass, the payload does not require any special privileges or user interaction, matching the CVSS vector (AV:N/AC:L/PR:N/UI:N).

4. Post-exploitation impact. Depending on how the application consumes the regex result, the attacker may achieve one of the following: (a) bypass of a blocklist — malicious content that should be matched and rejected is not flagged, allowing the content to pass; (b) validation bypass — an input that should be rejected as malformed or disallowed is accepted because the alternation matches a benign branch; (c) logical misrouting — classification or access decisions based on the matched offset/branch are applied to the wrong data. Per the CVSS vector, the direct confidentiality and integrity scores are None and the availability impact is Low (C:N/I:N/A:L); the practical damage is therefore operational and logical rather than direct data exfiltration or system compromise. In practice, an access-control or filtering layer that relies on such a regex could be systematically bypassed, turning a Low direct-availability issue into a higher-risk security boundary failure depending on the surrounding application logic.

Impact Assessment

Business impact: The vulnerability undermines the correctness guarantee of Perl's regex engine for applications running any version from 5.9.4 through 5.41.8. Organizations that use Perl-based filtering or access-control components (web application frameworks, mail content filters, log-analysis pipelines, custom validation scripts) could experience security-control bypasses that are silent — the application reports a legitimate match/no-match outcome, so the failure is invisible to operators. Because the trigger condition is input-dependent and intermittent, affected regexes may pass testing yet fail in production on specific inputs, making the issue difficult to diagnose.

Affected systems: All Perl interpreters in the range >= 5.9.4 and < 5.41.9. The vendor/product field in the CVE record is listed as unknown, but the NVD description unambiguously identifies Perl as the affected software. Third-party tooling that embeds Perl (e.g., mod_perl applications, CPAN-based daemons, Unix system utilities with Perl regex interfaces) inherits the flaw from the underlying interpreter. No per-package affected-version list is provided; OSV lists the advisory package as unfixed, meaning downstream distributions may still be shipping vulnerable interpreters.

Blast radius: The CVSS base score is 5.3 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The vector indicates an unauthenticated, remotely exploitable condition with low attack complexity and no user interaction; the scope is unchanged, and the subscores are C:N/I:N/A:L. The low availability subscore reflects the correctness/liveness impact on regex processing rather than a crash; however, the NVD description explicitly warns that "an access or filtering decision made from the result can be wrong," which means the effective severity in a specific deployment depends entirely on how the regex result is used. In a worst-case deployment — e.g., a network-accessible allowlist/blocklist filter where a false negative grants passage — the security impact materially exceeds the raw CVSS number.

Threat landscape: EPSS places the CVE at 0.00434 (36.2% percentile of exploited CVEs), indicating low near-term exploitation probability. There is no CISA KEV entry, no confirmed public PoC, no Nuclei template, and no exploit code. No known threat-actor campaigns have been publicly attributed to this CVE as of this writing. The absence of a confirmed patch (confidence 2/4) makes it a candidate for short-term monitoring rather than an active mass-exploitation risk.

Detection Guidance

Direct signature-based detection of this logic flaw is not practical because the trigger is a data-dependent automaton state condition, not a fixed byte sequence or malformed request. The rules below therefore target observable artifacts around the vulnerability class: execution of Perl with alternation-heavy regex patterns on the command line, presence of known trigger strings in scripts or network payloads, anomalous Perl process exits, and web/application logs containing the documented test-case patterns. These rules are heuristics and will require tuning to the local environment.

Sigma Rule

title: Suspicious Perl Execution with Multi-Branch Alternation Regex
id: 6f2a8b4e-9c70-4d1f-b3a2-77f1c8e04a10
status: experimental
description: >
  Detects execution of the Perl interpreter with a command line or script that
  embeds regex alternation patterns (multiple branches separated by '|').
  Correlates with CVE-2026-19487, an Aho-Corasick prescan logic flaw in
  S_find_byclass affecting Perl 5.9.4 to < 5.41.9. High false-positive rate;
  tune to monitored applications.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-19487
logsource:
  category: process_creation
  product: linux
detection:
  selection_perl:
    Image|endswith: '/perl'
    CommandLine|contains: '|'
  selection_regex:
    CommandLine|contains:
      - 'm/'
      - '(?:'
      - '|'
  condition: selection_perl and selection_regex
falsepositives:
  - Legitimate Perl one-liners using alternation (e.g., sed-like text processing)
  - Cron jobs and admin scripts that perform text parsing
level: low

YARA Rule

rule CVE_2026_19487_Perl_Regex_Alternation_Trigger
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects embedded Perl regex alternation patterns consistent with the CVE-2026-19487 trigger condition (stale failure flag in Aho-Corasick prescan in S_find_byclass)."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19487"
        date = "2026-01-01"
        hash = "unknown"
    strings:
        $test1 = "ABCF|BCDE|C" ascii wide
        $test2 = "ABCF|BCDE|C(G)" ascii wide
        $alt = /(?:[A-Za-z0-9_]+\\|[A-Za-z0-9_]+){2,}/ ascii
        $perl_open = "use re" ascii wide
        $perl_match = "=~ m/" ascii wide
    condition:
        any of ($test*) or
        (uint16(0) == 0x5A4D and $alt and 1 of ($perl*)) or
        ($alt and $perl_match and filesize < 5MB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPERIMENTAL Perl Aho-Corasick Prescan Trigger Pattern (CVE-2026-19487)"; flow:established,to_server; content:"ABCF|BCDE|C"; nocase; sid:202619487; rev:1; classtype:attempted-recon; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-19487; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

// EQL: Perl process with regex alternation followed by abnormal exit
sequence by host.id, process.entity_id with maxspan=30s
  [ process where event.category == "process" and process.name == "perl"
      and process.command_line like "*|*" ]
  [ process where event.category == "process" and event.action == "end"
      and process.name == "perl" and process.exit_code != 0 ]

Splunk SPL Query

(index=main sourcetype="WinEventLog:Security" EventCode=4688 New_Process_Name="*\\perl*")
OR (index=main sourcetype="linux_audit" comm="perl")
| where match(process_command_line, "m/[^|]+\\|[^|]+\\|")
| eval trigger_cve = if(match(process_command_line, "ABCF\\|BCDE\\|C"), "known-trigger", "possible")
| stats count by host, user, process_command_line, trigger_cve
| sort - count

Wazuh OSSEC Rule

<group name="perl,">
  <rule id="194870" level="6" frequency="5" timeframe="300">
    <if_sid>5715</if_sid> <!-- parent: syslog command execution, adjust per environment -->
    <field name="audit.data.cmd">perl</field>
    <match>ABCF\|BCDE\|C</match>
    <description>CVE-2026-19487: Known trigger pattern for Perl Aho-Corasick prescan flaw observed in command line.</description>
    <group>vulnerability,regex,perl,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>

  <rule id="194871" level="4">
    <if_sid>194870</if_sid>
    <regex>\\\|.*\\\|</regex> <!-- multiple alternation branches -->
    <description>CVE-2026-19487: Perl process with multi-branch alternation regex (generic heuristic).</description>
    <group>vulnerability,regex,perl,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is rated 2/4 (CLAIMED) — a single source (OSV) asserts a patch exists, but it has not been independently confirmed, and the OSV package state shows "unfixed." Treat the fix as unverified until Perl.org or your distribution vendor issues an advisory.

1. Immediate mitigations (no vendor fix confirmed):

   • Audit all security-critical regular expressions in Perl code for alternation patterns with overlapping candidate prefixes (e.g., branches that share leading characters or can match at the same starting offsets). Such patterns are most likely to encounter the stale-flag condition.
   • Where possible, replace multi-branch alternation with explicit, anchored, or fully-specified patterns (e.g., use negative lookarounds or capture groups that disambiguate the intended branch) to reduce reliance on the prescan's candidate-selection logic.
   • Add a defensive post-match verification layer: for allowlist/blocklist decisions, re-run the match with a canonicalized pattern (for example, using index() or anchored full-match semantics) and compare results. Treat divergent results as a security event.
   • If the affected Perl interpreter cannot be upgraded, wrap regex-based access/filtering decisions behind a higher-level allowlist (e.g., validate input at the application layer with exact string comparison) so that a false regex negative does not grant passage.
   • Monitor for the documented trigger strings ("ABCF|BCDE|C", "ABCF|BCDE|C(G)") in web, mail, and application logs as a low-confidence indicator of active probing.

2. Patch / upgrade steps:

   • Upgrade to Perl 5.41.9 or later, which the NVD range indicates as the first fixed version ("before 5.41.9" are affected). Until the fix is independently confirmed, validate the upgrade with regression tests using the two NVD example patterns against a freshly built interpreter.
   • Track the OSV advisory (package 27e0a6173cfa04e70f8057a8b3a0ceb668a33dbc) for updated state information; once downstream patches land, prioritize maintenance releases for your distribution (e.g., 5.40.x/5.38.x backports) over development-line upgrades if your environment requires production stability.
   • Before patching, snapshot the outputs of your Perl regex test suite for security-critical patterns; after patching, re-run the suite and diff results.

3. Long-term hardening:

   • Keep all Perl deployments current and subscribe to Perl security announcements so that future engine-level flaws are acted on promptly.
   • Add fuzzing and regression testing for any regex that participates in a security decision; include the CVE trigger pattern class (recorded candidate + later successful fail-link fallback) in your test corpus.
   • Prefer non-regex parsing (dedicated parsers, tokenizers, exact-match data structures) for untrusted input at security boundaries; regex should be a presentation/validation convenience, not the sole access-control mechanism.
   • Re-evaluate third-party Perl-based appliances and libraries for embedded interpreters; many ship their own Perl copies and will not inherit OS-level package updates. If no fixed interpreter is available from the vendor, isolate the affected component off the network until a patch is confirmed.

References

• NVD — CVE-2026-19487: https://nvd.nist.gov/vuln/detail/CVE-2026-19487
• OSV Advisory — CVE-2026-19487: https://osv.dev/vulnerability/CVE-2026-19487
• CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-19487
• Perl Security Information (official announcements): https://www.perl.org/security.html
• CISA Known Exploited Vulnerabilities Catalog (not listed — no in-the-wild evidence as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns, active exploitation, or exploit-in-the-wild evidence has been identified for this CVE at the time of writing. All technical claims above are derived strictly from the NVD description, the CNA metadata, and the OSV package reference provided; where implementation details were not available, the analysis describes the vulnerability class rather than inventing specifics.