{"id":"CVE-2026-112921","kind":"vulnerability","aliases":["CVE-2026-112921"],"related":[],"title":"Perl Robots::Validate: stale matcher state flags real visitors as fake robots","description":"Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.\n\nEach Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails.\n\nA remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated.\n\nNote that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.","summary":"Robots::Validate for Perl keeps Aho-Corasick matcher state between User-Agent checks on the same object. A crafted User-Agent can leave that state half-matched so the next visitor's User-Agent is wrongly treated as an impostor robot and blocked.","severity":"unknown","cvss":null,"epss":0.00229,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","perl","robots-validate","self-hosted"],"not_affected_if":["module-not-used","version-0.4.10-or-later"],"how_to_check":"- Check the installed version of the Perl Robots::Validate module, for example `perl -MRobots::Validate -e 'print $Robots::Validate::VERSION'`\n- Check whether Algorithm::AhoCorasick::XS is installed, which the sources say does not avoid the flaw","fix":"- Upgrade Robots::Validate to `0.4.10` or later\n- The sources do not name another workaround","status":"open","published_at":"2026-10-21T22:16:48+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T05:02:00+00:00","updated_at":"2026-10-25T05:02:00+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T05:02:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Robots::Validate to `0.4.10` or later\n- The sources do not name another workaround","reach":"internet","title":"Perl Robots::Validate: stale matcher state flags real visitors as fake robots","impact":"low","summary":"Robots::Validate for Perl keeps Aho-Corasick matcher state between User-Agent checks on the same object. A crafted User-Agent can leave that state half-matched so the next visitor's User-Agent is wrongly treated as an impostor robot and blocked.","category":"package","nicknames":[],"who_cares":["perl","robots-validate","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Legitimate visitors get blocked as fake robots by a remote client","analyst_note":"","how_to_check":"- Check the installed version of the Perl Robots::Validate module, for example `perl -MRobots::Validate -e 'print $Robots::Validate::VERSION'`\n- Check whether Algorithm::AhoCorasick::XS is installed, which the sources say does not avoid the flaw","needs_analyst":false,"not_affected_if":["module-not-used","version-0.4.10-or-later"],"who_is_affected":"Sites that use Robots::Validate to block impostor robots, where the same validator object handles many requests. Per the sources, installing Algorithm::AhoCorasick::XS does not avoid it. Sites that do not use this module are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":3526,"output_tokens":536,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-112921':15A,18A '-2026':14A,17A '0.4.10':81C '0.4.3':79C 'address':164C 'affect':218C 'agent':40B,50B,65B,92C,120C,130C,151C,199C 'aho':33B,111C 'aho-corasick':32B,110C 'ahocorasick':214C 'algorithm':213C 'also':217C 'bad':189C 'block':74B,188C,191C 'bug':227C 'carri':95C 'check':41B,152C,167C 'client':85C,162C,179C 'complet':158C 'corasick':34B,112C 'craft':47B 'cve':13A,16A 'deploy':211C 'differ':226C 'dns':172C 'due':223C 'end':132C 'everi':117C 'fail':176C 'fake':11A 'feed':116C 'flag':7A 'half':56B 'half-match':55B 'hold':105C 'host':26B 'impost':87C 'impostor':71B 'keep':31B 'leav':52B,140C 'machin':114C,142C 'make':184C 'match':57B,145C 'matcher':5A,35B,93C 'mid':144C 'mid-match':143C 'name':139C,160C 'next':60B,148C 'note':209C 'object':45B,104C,156C 'one':106C 'packag':19B 'part':134C 'part-way':133C 'perl':1A,20B,30B,83C,109C 'prefix':196C 'previous':99C 'pure':108C 'pure-perl':107C 'real':8A 'remot':178C 'report':84C 'request':100C 'reset':124C 'robot':2A,12A,22B,27B,72B,75C,88C,102C,138C,170C,190C,206C 'robots-valid':21B 'rule':173C 'search':113C 'self':25B 'self-host':24B 'sinc':219C 'site':186C 'stale':4A 'state':6A,36B,54B,94C,126C 'string':200C 'suffix':203C 'treat':68B 'unus':222C 'use':181C 'user':39B,49B,64B,91C,119C,129C,150C,198C 'user-ag':38B,48B,63B,90C,118C,128C,149C,197C 'valid':3A,23B,28B,76C,103C,208C 'version':77C 'visitor':9A,61B,193C 'way':135C 'without':123C 'wrong':67B 'xs':215C","nicknames":[],"mitigations":[],"who_affected":"Sites that use Robots::Validate to block impostor robots, where the same validator object handles many requests. Per the sources, installing Algorithm::AhoCorasick::XS does not avoid it. Sites that do not use this module are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T22:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112921","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112921","severity":null,"published_at":"2026-10-21T22:16:48+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-112921","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112921","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}