CVE-2026-49146: CWE-770 Allocation of Resources Without Limits or Throttling in PETDANCE App::Ack
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.
AI Analysis
Technical Summary
The vulnerability in App::Ack (CVE-2026-49146) arises from the lack of limits or throttling on resource allocation when parsing the project .ackrc configuration file. The -B and -C options control the size of before-context and after-context buffers, respectively, and accept any positive integer. An attacker can specify a very large value (e.g., --before-context=100000000) in a project .ackrc file, causing ack to allocate a buffer with 100 million elements, leading to memory exhaustion and process termination. This is classified under CWE-770: Allocation of Resources Without Limits or Throttling. The issue affects all versions prior to 3.10.0.
Potential Impact
An attacker who can influence the project .ackrc file (e.g., by committing it to an untrusted repository) can cause the ack tool to consume excessive memory and abort due to an out-of-memory condition. This results in a denial of service for users running ack in that project directory. There is no indication of code execution or data corruption from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running ack in directories containing untrusted project .ackrc files or review and sanitize .ackrc files before use to ensure context options do not specify excessively large values.
CVE-2026-49146: CWE-770 Allocation of Resources Without Limits or Throttling in PETDANCE App::Ack
Description
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in App::Ack (CVE-2026-49146) arises from the lack of limits or throttling on resource allocation when parsing the project .ackrc configuration file. The -B and -C options control the size of before-context and after-context buffers, respectively, and accept any positive integer. An attacker can specify a very large value (e.g., --before-context=100000000) in a project .ackrc file, causing ack to allocate a buffer with 100 million elements, leading to memory exhaustion and process termination. This is classified under CWE-770: Allocation of Resources Without Limits or Throttling. The issue affects all versions prior to 3.10.0.
Potential Impact
An attacker who can influence the project .ackrc file (e.g., by committing it to an untrusted repository) can cause the ack tool to consume excessive memory and abort due to an out-of-memory condition. This results in a denial of service for users running ack in that project directory. There is no indication of code execution or data corruption from the provided information.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid running ack in directories containing untrusted project .ackrc files or review and sanitize .ackrc files before use to ensure context options do not specify excessively large values.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-05-27T17:50:04.538Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4e65c2c9d9e3dbe34c9afd
Added to database: 07/08/2026, 14:59:14 UTC
Last enriched: 07/08/2026, 15:13:53 UTC
Last updated: 07/08/2026, 15:58:55 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.