Ack for Perl allows a user‑defined context value to dictate the size of an internal buffer used for formatting search results. This is a CWE‑770 weakness. The –B and –C options accept any positive integer and exact size; a malicious project .ackrc containing a line such as --before-context=100000000 therefore causes Ack to request a buffer of 100 million elements, exhausting available memory and causing the program to abort with an out‑of‑memory error. This results in a denial of service for any user running Ack against a repository contains such a .ackrc, effectively disrupting workflows and potentially allowing exploitation through resource exhaustion when the program repeatedly restarts or hangs.

The vulnerability is present in all sources of Petdance's App::Ack Perl module prior to version 3.10.0. Users who deploy Ack in environments that read project .ackrc files from repositories hosted or accessed by untrusted users are most at risk, especially when a crafted .ackrc file is present in a repository that Ack will search.

The CVSS base score for this issue is 7.5, indicating a high‑severity denial of service weakness. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but the exploit potential remains significant because any run of Ack against a repository containing a malicious .ackrc leads to a crash. The attack vector is inferred to be local or remote depending on who can commit an arbitrary .ackrc, and thus defenders should consider the possibility of an attacker forging a repository or influencing a build environment.