Robots-Validate: User-Agent matcher state leakage (CVE-2026-112921)
The Robots-Validate Perl module (versions 0.4.3 through 0.4.9) fails to clear User-Agent matcher state between requests, causing legitimate clients to be incorrectly classified as imposter robots.
CVE search metadata
CVE search record: CVE-2026-112921. KEV: no. Product: Robots-Validate (0.4.3-0.4.9). Brief: Robots-Validate: User-Agent matcher state leakage (CVE-2026-112921). Brief link: https://feed.craftedsignal.io/briefs/2026-10-robots-validate-state-leak/
Triage facts
Revision 1- Applicability
- Robots-Validate (0.4.3-0.4.9)
- Evidence
- Unknown
- Severity
- Low
- Action
- Monitor or close
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 22, 01:36 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Unlikely
The Robots-Validate Perl module, specifically versions 0.4.3 through 0.4.9, contains a flaw where the internal state of the User-Agent matcher persists across consecutive requests. This leakage can result in false positive identifications of legitimate clients as imposter robots. The issue is resolved in version 0.4.10.
Impact
The vulnerability may cause unexpected denial of service or access rejection for legitimate web clients when using the affected module for request validation.
Recommendation
- Audit systems for usage of the Robots-Validate Perl module.
- Upgrade the Robots-Validate module to version 0.4.10 or later.
Mitigations
Upgrade Robots-Validate to version 0.4.10 or later
CVE-2026-112921