Robots::Validate before 0.4.10 mislabels clients as robots (CVE-2026-112921)
Original title: CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request
User-Agent matcher state from an earlier request can make the next client look like an imposter robot.
Robert Rothenberg reported CVE-2026-112921 in the Perl distribution Robots::Validate on oss-security. Versions from 0.4.3 before 0.4.10 can report clients as imposter robots when User-Agent matcher state carries over from a previous request. The note points to the MetaCPAN release; the snippet does not discuss exploitation or a patch timeline.
Unconfirmed: The feed snippet does not state whether 0.4.10 is already published or whether the issue has been exploited.
- Affected range stated in the report is 0.4.3 before 0.4.10.
- The bug is leftover matcher state between requests, not a remote code flaw.
- The oss-security post is dated October 21.
Impact: Clients can be wrongly reported as imposter robots
| Product | Affected | Fixed in |
|---|---|---|
| Robots::Validate | 0.4.3 before 0.4.10 | 0.4.10 |
- 1.Upgrade Robots::Validate to 0.4.10 or later.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-112921 | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request | 7.3 | — |
From the original article
Posted by Robert Rothenberg on Oct 21 ======================================================================== https://metacpan. org/dist/Robots-Validate VCS Repo:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.