CVE-2026-49146
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Jul 8, 2026
CISA due date
—
The record
App::Ack versions before 3.10.0 for Perl allow memory exhaustion via an unbounded context value in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The -B and -C context options accepted any positive integer, and ack sized the before-context buffer to that value, so a project .ackrc setting --before-context=100000000 made ack allocate a buffer of 100 million elements. A project .ackrc committed to an untrusted repository can abort ack with an out-of-memory condition.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | ack | 0 | 3.10.0-1.1 |
Related vulnerabilities
- CVE-2026-49147 App::Ack versions through 3.10.0 for Perl print unsanitised terminal escape sequences… Also affects ack
- CVE-2026-49145 App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a… Also affects ack
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770
- CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined… CWE-770
- CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform… CWE-770
- CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource… CWE-770
- CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory… CWE-770
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-770