CVE-2026-49146
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in App::Ack for Perl before version 3.10.0 allows memory exhaustion via an unbounded context value in a project .ackrc. Ack searches the directory hierarchy for .ackrc and loads its options, where -B and -C accept any positive integer, potentially allocating a huge buffer.
Risk Assessment
The risk is that a malicious .ackrc in an untrusted repository can crash ack due to out-of-memory, potentially disrupting system or CI/CD processes.
Recommendation
It is recommended to immediately upgrade App::Ack to version 3.10.0 or later, which includes a fix to limit context values.
Other vulnerabilities in App::Ack
See all- CVE-2026-49147High
A vulnerability in App::Ack through version 3.10.0 for Perl causes unsanitized terminal escape sequences from filenames to be printed in several output modes. When ack prints a filename containing terminal control bytes like ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitizes filenames in -f, -g, colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.
- CVE-2026-49145High
A vulnerability in App::Ack for Perl (up to version 3.10.0) allows reading arbitrary files via the --files-from option in a project .ackrc file. Ack searches the directory hierarchy for .ackrc and loads its options, but the option blocklist does not include --files-from, enabling a malicious repository to read files outside the project.
Original NVD description (English source)
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.