CVE-2026-19487

A flaw was found in Perl. The regular expression engine may produce incorrect match results due to a stale failure flag in the Aho-Corasick prescan, which causes it to end prematurely. This can lead to the engine missing valid matches or matching on the wrong branch. As a result, applications that use regular expressions for critical functions like access control or data filtering could make erroneous decisions, potentially leading to security bypasses or unintended information disclosure.

Red Hat is aware of a flaw in Perl's regular expression engine where a stale failure flag in the Aho-Corasick prescan can cause the engine to terminate early, potentially missing valid matches or matching on the wrong alternation branch. Applications using Perl regular expressions for access control or filtering decisions may produce incorrect results. Red Hat products are affected and updates will be provided when available.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

There is no mitigation available. Applications relying on Perl regular expressions for security-critical decisions (access control, input filtering) should implement defense-in-depth measures and monitor for updates.