CVE-2026-80490: Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified
CVE-2026-80490 in Perl's Algorithm::AhoCorasick::XS through 0.04 reads haystack length before scalar stringification, causing incorrect search behavior.
Robert Rothenberg disclosed CVE-2026-80490 affecting Algorithm::AhoCorasick::XS versions through 0.04 for Perl. The XS extension reads the haystack string length before the scalar is stringified, which can produce wrong results when a non-string scalar is passed. Users of the CPAN distribution should upgrade once a fixed release is available.
- Affects Algorithm::AhoCorasick::XS through version 0.04
- Module reads haystack length before Perl scalar stringification
- Niche CPAN module; no exploitation reported
- CVEs
- CVE-2026-80490
- Organizations
- Algorithm::AhoCorasick::XSRobert Rothenberg
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-80490 | Out-of-bounds read crash in Perl Algorithm::AhoCorasick::XS | 4.4 | — |
From the original article
Posted by Robert Rothenberg on Sep 30 ======================================================================== https://metacpan. org/dist/Algorithm-AhoCorasick-XS VCS Repo:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.