CVE-2026-112921
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request
- State
- Published
- Severity
- 7.3 High
- Published
- Oct 21, 2026
- Updated
- Oct 30, 2026
- Reserved
- Oct 19, 2026
Description
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.
Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails.
A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated.
Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.3 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | CISA-ADP |
Weaknesses
- CWE-488 Exposure of Data Element to Wrong Session
Affected Products
| Product | Versions |
|---|---|
Robots-Validate |
|
References
- https://github.com/robrwo/Robots-Validate/commit/776a1456e6605492b7582ed25d3d5006ef384402.patchpatch
- https://metacpan.org/release/RRWO/Robots-Validate-v0.4.10/changesrelease-notes
- https://metacpan.org/release/RRWO/Robots-Validate-v0.4.11/changesrelease-notes
- http://www.openwall.com/lists/oss-security/2026/10/21/30
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.