CVE catalog

CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subjec

[CVE catalog]

Severity: Medium · CVSS 5.7CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Published: Aug 9, 2026, 6:16:42 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.42% · Oct 23, 2026

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds. Example: "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	perl	sid	`5.42.3-1`	fixed
Debian	perl	forky	`5.42.3-1`	fixed
Debian	perl	trixie	`5.40.1-6+deb13u1`	fixed
Debian	perl	bookworm	`5.36.0-7+deb12u3`	vulnerable
Debian	perl	bookworm-security	`5.36.0-7+deb12u4`	fixed
Ubuntu	perl	noble	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	libperl-dev	noble	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	libperl5.38t64	noble	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	perl-base	noble	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	perl-debug	noble	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	perl-doc	noble	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	perl-modules-5.38	noble	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	perl	pro	`5.28.1-6build1`	vulnerable
Ubuntu	perl	pro	`5.30.0-7`	vulnerable
Ubuntu	perl	pro	`5.30.0-9`	vulnerable
Ubuntu	perl	pro	`5.30.0-9build1`	vulnerable
Ubuntu	perl	pro	`5.30.0-9ubuntu0.2`	vulnerable
Ubuntu	perl	pro	`5.30.0-9ubuntu0.3`	vulnerable
Ubuntu	perl	pro	`5.30.0-9ubuntu0.4`	vulnerable
Ubuntu	perl	pro	`5.30.0-9ubuntu0.5`	vulnerable
Ubuntu	perl	pro	`5.30.0-9ubuntu0.5+esm2`	vulnerable
Ubuntu	perl	pro	`5.30.0-9ubuntu0.5+esm3`	vulnerable
Ubuntu	perl	pro	`5.30.0-9ubuntu0.5+esm4`	fixed
Ubuntu	perl	22.04	`5.32.1-3ubuntu3`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.1`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.2`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.3`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.4`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.5`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.7`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.8`	vulnerable
Ubuntu	perl	22.04	`5.34.0-3ubuntu1.9`	fixed
Ubuntu	perl	24.04	`5.36.0-9ubuntu1`	vulnerable
Ubuntu	perl	24.04	`5.36.0-10ubuntu1`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2build1`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2build2`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2build2.1`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2ubuntu0.1`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2ubuntu0.2`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2ubuntu0.3`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2ubuntu0.4`	vulnerable
Ubuntu	perl	24.04	`5.38.2-3.2ubuntu0.6`	fixed
Ubuntu	perl	26.04	`5.40.1-6build1`	vulnerable
Ubuntu	perl	26.04	`5.40.1-7build1`	vulnerable
Ubuntu	perl	26.04	`5.40.1-7ubuntu0.1`	vulnerable
Ubuntu	perl	26.04	`5.40.1-7ubuntu0.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	perl	source	sid	`5.42.2-3`	not yet assigned	Not reported	[1144668]
Debian	perl	source	forky	`5.42.2-3`	not yet assigned	Not reported	[1144668]
Debian	perl	source	trixie	`5.40.1-6+deb13u1`	not yet assigned	Not reported	[1144668]
Debian	perl	source	bookworm	`5.36.0-7+deb12u4`	not yet assigned	Not reported	[1144668]
Ubuntu	perl	deb	noble	`5.38.2-3.2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	libperl-dev	deb	noble	`5.38.2-3.2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	libperl5.38t64	deb	noble	`5.38.2-3.2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	perl-base	deb	noble	`5.38.2-3.2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	perl-debug	deb	noble	`5.38.2-3.2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	perl-doc	deb	noble	`5.38.2-3.2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	perl-modules-5.38	deb	noble	`5.38.2-3.2ubuntu0.6`	Not reported	Not reported	Not reported
Ubuntu	perl	deb	pro	`5.30.0-9ubuntu0.5+esm4`	Not reported	UBUNTU-CVE-2026-19487	Not reported
Ubuntu	perl	deb	22.04	`5.34.0-3ubuntu1.9`	Not reported	UBUNTU-CVE-2026-19487	Not reported
Ubuntu	perl	deb	24.04	`5.38.2-3.2ubuntu0.6`	Not reported	UBUNTU-CVE-2026-19487	Not reported
Ubuntu	perl	deb	26.04	`5.40.1-7ubuntu0.2`	Not reported	UBUNTU-CVE-2026-19487	Not reported

[Debian bug #1144668]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libperl5.36]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[libperl-dev]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl]Affected
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-base]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-debug]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · amd64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · arm64 · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · amd64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · arm64 · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-doc]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
[perl-modules-5.36]Affected
Source package: [perl]
Details (4)
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u3 · all · bookworm
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12
- 5.36.0-7+deb12u2 · all · bookworm-security
  Affected · Fixed: 5.36.0-7+deb12u4
  nvd · perl · debian · bookworm; nvd · perl · debian · 12

[Debian 13 (Trixie)]

[libperl5.40]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[libperl-dev]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl]Affected
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-base]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-debug]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · amd64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · arm64 · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-doc]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
[perl-modules-5.40]Affected
Source package: [perl]
Details (2)
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13
- 5.40.1-6 · all · trixie
  Affected · Fixed: 5.40.1-6+deb13u1
  nvd · perl · debian · 13

Observed: Oct 23, 2026, 9:42:29 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]