Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails.
A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated.
Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Robrwo | Robots::validate | 75% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
Vendor Solution
Upgrade to Robots-Validate v0.4.10 or later. Deployments with Algorithm::AhoCorasick::XS should upgrade to v0.4.11, which fixed a bug with using that version.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 30 Oct 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Thu, 22 Oct 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Robrwo
Robrwo robots::validate |
|
| Vendors & Products |
Robrwo
Robrwo robots::validate |
Thu, 22 Oct 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 21 Oct 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request. Each Robots::Validate object holds one pure-Perl Aho-Corasick search machine and feeds every User-Agent into it without resetting its state. A User-Agent that ends part-way through a robot name leaves the machine mid-match, so the next User-Agent checked by the same object can complete that name. That client's address is then checked against the robot's DNS rule, which it fails. A remote client can use this to make a site that blocks bad robots block other visitors where the prefix User-Agent string is a suffix of a robot being validated. Note that deployments with Algorithm::AhoCorasick::XS are also affected, since it was unused due to a different bug. | |
| Title | Robots::Validate versions from 0.4.3 before 0.4.10 for Perl report clients as imposter robots when User-Agent matcher state carries over from a previous request | |
| Weaknesses | CWE-488 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-10-30T17:25:36.728Z
Reserved: 2026-10-19T21:17:46.149Z
Link: CVE-2026-112921
Vulnrichment
Updated: 2026-10-22T00:16:41.831Z
NVD
Status : Deferred
Published: 2026-10-21T22:16:48.527
Modified: 2026-10-30T18:17:21.773
Link: CVE-2026-112921
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-22T10:40:22Z