Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-112921— Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request

Quick assessment

Affected
CVE-2026-112921
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Robots::Validate 模块在 0.4.3 至 0.4.10（不含 0.4.10）版本中，当 User-Agent 匹配器的状态从上一次请求延续时，会错误地将正常的 Perl 客户端报告为伪装机器人（imposter robots）。 每个 Robots::Validate 对象维护一个纯 Perl 实现的 Aho-Corasick 搜索机，并在处理每个 User-Agent 时未重置其内部状态。若某个 User-Agent 字符串在机器人名称的中间位置结束，会导致搜索机停留在“部分匹配”状态；随后由同一

AI Predicted 6.5 Difficulty: Easy

Possible ATT&CK Techniques 1 AI

T1053 · Scheduled Task/Job

I. Basic Information for CVE-2026-112921

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request
Source: CVE Program / CVE List V5
Vulnerability Description
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails. A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated. Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对错误会话暴露数据元素
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0.4.3 ~ 0.4.10 -

II. Public POCs for CVE-2026-112921

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-112921

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-112921 (1)

Other References for CVE-2026-112921 (2)

IV. Related Vulnerabilities

Same weakness: CWE-488

V. Comments for CVE-2026-112921

No comments yet

Leave a comment