Robots::Validate uses a pure-Perl Aho-Corasick automaton that retains its match state between User-Agent headers. When a request's User-Agent string ends in the middle of a known robot name, the internal state remains in a mid-match state. The next request's User-Agent can then complete that robot name, causing the client to be mistakenly identified as an imposter robot and blocked. This flaw allows a remote user to induce false positive robot detections without authentication and leads to denial of service for legitimate visitors whose User-Agent prefixes match robot suffixes.

Perl report clients that rely on Robots::Validate version 0.4.3 through 0.4.9, and any installations using Algorithm::AhoCorasick::XS which were also affected due to a separate bug preventing the alternate matcher from being used. Versions 0.4.10 and later, including 0.4.11 for Algorithm::AhoCorasick::XS, contain the necessary fix.

The vulnerability can be exploited by any remote client capable of sending HTTP requests with crafted User-Agent headers; no authentication is required. The CVSS score of 7.3 indicates high severity, and the EPSS score of < 1% suggests low likelihood of current exploitation, but the flaw permits an attacker to block legitimate traffic by exploiting the stateful nature of the matcher. It is not listed in CISA’s KEV catalog. The risk is moderate to high for sites that depend on Robots::Validate for robot filtering.