CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...

CVE-2026-19487

Perl 5.9.4 up to 5.41.8 has a bug in the Aho-Corasick prescan (S_find_byclass) where a stale failure flag is not cleared, causing incorrect regex match results. In the prescan, the engine may stop early and miss valid alternatives or select the wrong match due to a lingering failure flag after tr...