Algorithm::AhoCorasick::XS in Perl versions through 0.04 uses a typemap that reads the haystack string length before converting a Perl scalar to a string. When the input scalar is a reference, an integer, or a floating point value, the length macro returns an invalid value before stringification, causing an out‑of‑bounds read that can abort the process. Because the evaluation order of the std::string constructor arguments is unspecified, a compiler that evaluates the length first will immediately trigger a crash that cannot be caught in Perl. The result is a denial of service through process termination.

Perl environments that use the CPAN module Algorithm::AhoCorasick::XS at version 0.04 or earlier. The vulnerability applies to any script or application that creates an Algorithm::AhoCorasick::XS object with a haystack containing numeric values, objects, or values obtained from decoded JSON or database columns.

The vulnerability is unpatched at present and is identified as CWE‑125, an out‑of‑bounds read. The EPSS score indicates a very low probability of exploitation (<1%), and the issue is not listed in the CISA KEV catalog. The CVSS score of 4.4 classifies the overall impact as low‑to‑moderate; however, its effect is a process termination that results in a denial of service. An attacker can supply numeric or non‑string input to the matches, first_match or match_details methods to trigger the crash. Deployment scenarios that expose the module to untrusted input – such as web applications or services processing external data – are most susceptible. Because the defect cannot be mitigated locally within Perl, the recommended defense is to apply the provided patch or to ensure that all inputs are explicitly stringified before being processed by the module.