CVE-2026-112921
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in the Perl Robots::Validate library (versions 0.4.3 to 0.4.10) allows the state of the Aho-Corasick matcher used for User-Agent matching to persist across requests. If a User-Agent ends partway through a robot name, the next User-Agent checked by the same object can complete that name, causing misclassification of the client as a robot.
Risk Assessment
A remote client can exploit this to make a site that blocks bad robots block other visitors whose User-Agent prefix is a suffix of a robot name. This can lead to denial of access for legitimate users.
Recommendation
Update Robots::Validate to version 0.4.10 or later, which fixes the state reset issue. If using Algorithm::AhoCorasick::XS, apply the corresponding update as well.
Other vulnerabilities in Robots::Validate
Original NVD description (English source)
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails. A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated. Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS