CVE-2026-112921 Details
Description
Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails. A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated. Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
A vulnerability exists in Robots::Validate versions 0.4.3 prior to 0.4.10, where the User-Agent matching state is not reset between requests. This flaw allows a remote client to manipulate the User-Agent string in a way that can disrupt a site's robot validation process, potentially causing it to incorrectly identify genuine robots as imposters. The issue arises because each Robots::Validate object maintains a single Aho-Corasick search machine that processes User-Agent strings without resetting. As a result, a string that partially matches a robot name can be completed by a subsequent User-Agent, leading to incorrect DNS rule validation. This vulnerability also affects deployments using Algorithm::AhoCorasick::XS, although that version was temporarily disabled due to a separate bug.
Users are advised to upgrade to Robots-Validate version 0.4.10 or later. Those with Algorithm::AhoCorasick::XS should upgrade to version 0.4.11, which addresses a related bug.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/Robots-Validate/commit/776a1456e6605492b7582ed25d3d5006ef384402.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/RRWO/Robots-Validate-v0.4.10/changes | CPANSec | Release NotesVendor |
| https://metacpan.org/release/RRWO/Robots-Validate-v0.4.11/changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/10/21/30 | CVE | AdvisoryMailing ListRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-488 | Exposure of Data Element to Wrong Session | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| Robots::Validate | >= 0.4.3, < 0.4.10 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 22, 2026 | CVE Modified | CVE |
| Oct 21, 2026 | New CVE Received | CPANSec |