Algorithm::AhoCorasick::XS in Perl versions through 0.04 uses a typemap that reads the haystack string length before converting a Perl scalar to a string. When the input scalar is a reference, an integer, or a floating point value, the length macro returns an invalid value before stringification, causing an out‑of‑bounds read that can abort the process. Because the evaluation order of the std::string constructor arguments is unspecified, a compiler that evaluates the length first will immediately trigger a crash that cannot be caught in Perl code. The result is a denial of service through process termination.

Perl environments that use the CPAN module Algorithm::AhoCorasick::XS at version 0.04 or earlier. The vulnerability applies to any script or application that creates an Algorithm::AhoCorasick::XS object with a haystack containing numeric values, objects, or values obtained from decoded JSON or database columns.

The vulnerability is unpatched at present and is categorized as CWE‑125, an out‑of‑bounds read. EPSS information is unavailable and the issue is not listed in the CISA KEV catalog, but the potential impact of an abrupt process termination makes it a high‑severity risk for services relying on that module. An attacker can supply a numeric input to the matches, first_match or match_details methods, or any other interface that forwards haystack data, to trigger the crash. Deployment scenarios that expose the module to untrusted input – such as web applications or services processing external data – are most susceptible. Because the flaw cannot be mitigated locally within Perl, the recommended defense is to apply the provided patch or to ensure that all inputs are explicitly stringified before being processed by the module.