Threats tagged 'ghsa-wh9j-9gh8-wm87'

Robots::Validate versions from 0.4.3 up to but not including 0.4.10 for Perl incorrectly identify legitimate clients as imposter robots due to a User-Agent matcher state carryover issue. This occurs because the internal Aho-Corasick search machine does not reset its state between User-Agent checks, allowing a partial match from one User-Agent to affect the next. This flaw can cause legitimate visitors to be blocked if their User-Agent string overlaps with a robot name suffix. The issue also affects deployments using Algorithm::AhoCorasick::XS due to a separate bug preventing its use.