CVE-2026-49146 Details
Description
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.
A memory exhaustion vulnerability has been identified in App::Ack versions prior to 3.10.0 for Perl. The issue arises from an unbounded context value in a project .ackrc file, which ack reads while searching up the directory hierarchy for configuration options. The context options -B and -C, which accept any positive integer, can be exploited by setting a very high value, such as 100 million, causing ack to allocate an excessive amount of memory. This vulnerability can be triggered by a project .ackrc file committed to an untrusted repository, leading to an out-of-memory condition.
Users can update to App::Ack version 3.10.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/beyondgrep/ack3/commit/45ff5fe77dbd96f7332f31943102291f878f30b8.patch | CPANSec | |
| https://metacpan.org/release/PETDANCE/ack-v3.10.0/source/Changes | CPANSec | Release NotesVendor |
| http://www.openwall.com/lists/oss-security/2026/07/08/8 | CVE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| App::Ack | < 3.10.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CVE |
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | CPANSec |