CVE-2026-49146

Name of the Vulnerable Software and Affected Versions App::Ack versions prior to 3.10.0

Description Memory exhaustion can occur when the software searches the directory hierarchy for a project .ackrc file and loads its options. The context options -B and -C accept any positive integer, and the software sizes the before-context buffer based on that value. Consequently, a setting such as --before-context=100000000 in a .ackrc file committed to an untrusted repository can cause the application to abort due to an out-of-memory condition.

Recommendations Update to version 3.10.0 or later.