CVE-2026-49146 App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc
An attacker can cause memory exhaustion and denial of service by providing a malicious .ackrc file with an excessively large context value.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49146?
CVE-2026-49146 is a high-severity denial of service vulnerability in PETDANCE App::Ack, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc.
ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements.
A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.
Weakness: CWE-770
Which versions are affected by CVE-2026-49146?
How do I fix CVE-2026-49146?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-49146 being exploited?
There is no known exploitation of CVE-2026-49146 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-49146, DEBIAN-CVE-2026-49146, GHSA-hf7w-mcpw-97mf, UBUNTU-CVE-2026-49146.