CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.<br /> <br /> The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.<br /> <br /> Example:<br /> <br /> "ABCDE" =~ m/ABCF|BCDE|C/; # matches C at offset 2, not BCDE<br /> "ABCDE" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed<br /> <br /> An alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong.