CVE-2026-19487

CVE-2026-19487 is a silent correctness failure in Perl's regex engine that has existed since approximately 2007. The bug lives in the Aho-Corasick prescan optimization—the same optimization that makes alternation-heavy patterns fast. When your regex has branches with common prefixes (like `ABCF|BCDE|C`), the optimizer can incorrectly match a shorter branch when a longer one should have matched. There's no error, no exception, no crash. Your code receives what looks like a valid match result and proceeds. This is a catastrophic failure mode for security code specifically because the conditions that trigger it are precisely the conditions where developers rely on regex: blocking known-bad inputs, validating paths, filtering content types. When you write `if ($input =~ /ABCF|BCDE|C/)` to catch dangerous patterns, the engine may return "C" instead of "BCDE" and your validation silently passes malicious input forward. Adding capturing groups can make the match fail entirely, breaking presence checks that should fire. Audit your Perl code for any regex alternations with shared prefixes used in security decisions—authentication, authorization, input filtering, path validation. These patterns are the trigger vector and exactly what blocklist implementations look like. If you maintain legacy Perl applications with regex-based security logic, treat this as high-priority: the bug has been silent for 17 years and there's no runtime signal when it fires. The low EPSS score reflects exploitability (there's no crash to detect), not severity. A silent semantic failure in security-critical validation is worse than a loud remote code execution bug—the latter gets caught, the former does not.

Reviewed through automated stages and approved by a human before publication.