CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request

Q: Which deployments are affected?

Deployments using Robots::Validate from version 0.4.3 up to, but not including, 0.4.10 are affected. Installations that have Algorithm::AhoCorasick::XS are also affected because that module was not used due to a separate bug.

Q: What does an attacker need to do to trigger the incorrect blocking?

The attacker must send a User-Agent that ends with a partial robot name, leaving the shared matcher in a mid-match state. A subsequent User-Agent processed by the same Robots::Validate object can complete that robot name and cause the subsequent client's address to be checked against the robot DNS rule.

Q: Who can be impacted by exploitation?

Sites that use this module to block bad robots can incorrectly block other visitors. The affected subsequent visitor needs a User-Agent whose value completes the robot-name match left by the prior request.

Published Oct 21, 2026

Updated

Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request.

Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails.

A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated.

Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.

Affected Software

1 affected component

cpan/Robots::Validate>=0.4.3<0.4.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Robots-Validate to a version that resolves this vulnerability.
Fixed in 0.4.10
Upgrade
Upgrade Algorithm::AhoCorasick::XS to a version that resolves this vulnerability.
Fixed in 0.4.11

Event History

Oct 21, 2026

CVE Published

via MITRE·09:37 PM

Data Sourced

via MITRE·09:37 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using Robots::Validate from version 0.4.3 up to, but not including, 0.4.10 are affected. Installations that have Algorithm::AhoCorasick::XS are also affected because that module was not used due to a separate bug.

What does an attacker need to do to trigger the incorrect blocking?

The attacker must send a User-Agent that ends with a partial robot name, leaving the shared matcher in a mid-match state. A subsequent User-Agent processed by the same Robots::Validate object can complete that robot name and cause the subsequent client's address to be checked against the robot DNS rule.

Who can be impacted by exploitation?

Sites that use this module to block bad robots can incorrectly block other visitors. The affected subsequent visitor needs a User-Agent whose value completes the robot-name match left by the prior request.

CVE-2026-112921: Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to trigger the incorrect blocking?

Who can be impacted by exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to do to trigger the incorrect blocking?

Who can be impacted by exploitation?