CVE-2026-112921 Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-112921?
CVE-2026-112921 is a vulnerability, published on 21 Oct 2026.
Official description
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.
Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails.
A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated.
Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
Weakness: CWE-488
Which versions are affected by CVE-2026-112921?
How do I fix CVE-2026-112921?
No fix has been published for CVE-2026-112921 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-112921 being exploited?
There is no known exploitation of CVE-2026-112921 in the wild and no public exploit code.
Sources
Also known as GHSA-wh9j-9gh8-wm87.