The flaw in Perl’s regex engine occurs when a stale failure flag in the Aho‑Corasick prescan prematurely terminates the scan, causing valid matches to be missed or wrong alternatives to be taken. This logic error can lead to access control bypasses or incorrect input filtering when applications rely on regular‑expression matches to make decisions. The weakness is classified as CWE‑670.

Perl interpreters from version 5.9.4 up through 5.41.8 are affected. The issue is fixed in Perl 5.42.0 and later, or can be remedied by applying the upstream patch supplied by the Perl project.

The vulnerability does not provide code execution or remote access. It can be exploited only by supplying crafted input to a regex routine in an affected Perl application. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 5.3, indicating a moderate level of severity. Consequently, the risk is limited to logic errors in input validation or filtering performed by legacy Perl code evident only when vulnerable regex patterns are evaluated.