CVE-2026-19487

Name of the Vulnerable Software and Affected Versions Perl versions 5.9.4 through 5.41.8

Description Incorrect regular expression match results occur when a stale failure flag causes the Aho-Corasick prescan to end prematurely in the S find byclass() function. The prescan identifies potential match positions in the subject, and the engine attempts matches from the leftmost recorded position. A failing transition sets a failed flag that is not cleared by subsequent successful transitions, leading the prescan to stop before recording candidates that start earlier. This behavior can cause alternations to miss valid input or match the wrong branch, potentially resulting in incorrect access or filtering decisions.

Recommendations Update Perl to version 5.41.9.