CVE-2026-49146: App::Ack for Perl DOS Vulnerability

CVE-2026-49146 Overview

CVE-2026-49146 is a memory exhaustion vulnerability affecting App::Ack versions before 3.10.0 for Perl. The ack tool searches up the directory hierarchy from the current working directory to locate a project .ackrc file and loads its options automatically. The -B and -C context options accept any positive integer, and ack sizes the before-context buffer to match that value. A malicious project .ackrc containing --before-context=100000000 causes ack to allocate a buffer of 100 million elements, aborting the process with an out-of-memory condition. The flaw is tracked as [CWE-770: Allocation of Resources Without Limits or Throttling].

Critical Impact
A .ackrc file committed to an untrusted repository can crash ack through uncontrolled memory allocation, disrupting developer workflows and CI pipelines that run ack against cloned source trees.

Affected Products

App::Ack versions prior to 3.10.0 for Perl
Distributions and CI environments bundling vulnerable ack releases
Developer systems processing untrusted repositories with ack

Discovery Timeline

2026-07-08 - CVE-2026-49146 published to the National Vulnerability Database (NVD)
2026-07-08 - Coordinated disclosure via OpenWall OSS-Security mailing list
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-49146

Vulnerability Analysis

The vulnerability stems from unbounded input handling in the context option parser of ack. When ack starts, it walks up the directory tree from the current directory looking for a project-level .ackrc configuration file. Any options found there are applied automatically without user confirmation. The -A (after-context), -B (before-context), and -C (context) options accept any positive integer without validation against a sane upper bound.

Internally, ack pre-allocates a ring buffer sized to the context value to hold surrounding lines. Passing an option such as --before-context=100000000 forces allocation of a buffer with 100 million elements, exhausting available memory. The Perl interpreter then aborts the process, producing a denial-of-service condition.

Root Cause

The root cause is missing input validation on integer arguments accepted by the -A, -B, and -C options. The parser trusts any positive integer and forwards it directly to the buffer allocation routine. Because .ackrc files are auto-loaded from the project directory, an attacker only needs to place a hostile configuration file in a repository to trigger the condition on any developer running ack.

Attack Vector

Exploitation requires an attacker to commit a crafted .ackrc file to a repository. When a victim clones the repository and runs ack anywhere inside the tree, the malicious context value is honored and memory is exhausted. No user interaction beyond invoking ack is required, and the attack scales to CI runners that automatically execute ack against pulled source code.

text

# Excerpt from the ack3 Changes file documenting the fix
NEXT
========================================
[SECURITY]
CVE-2026-49147: filename ANSI escape sequences
CVE-2026-49146: project .ackrc -A -B -C memory exhaustion
CVE-2026-49145: project .ackrc --follow / --files-from file exfiltration

[FIXES]
Fixed a bug where types set in the .ackrc could not be overridden from the
command line. Thanks, Dmitri Vereshchagin. (GH #393)

Source: ack3 commit 45ff5fe

Detection Methods for CVE-2026-49146

Indicators of Compromise

Presence of a .ackrc file in a cloned repository containing --before-context, --after-context, or -C values with unusually large integers
ack process terminations with out-of-memory errors on developer workstations or CI runners
Rapid resident-set-size growth for perl processes launched with ack in the command line

Detection Strategies

Scan repositories for .ackrc files containing context options with values exceeding a reasonable ceiling, such as a few thousand lines
Alert on perl or ack processes whose memory allocations spike beyond baseline within seconds of invocation
Audit CI/CD job logs for Out of memory or Killed signals correlated with ack invocations

Monitoring Recommendations

Track versions of App::Ack installed on build infrastructure and developer endpoints and flag anything below 3.10.0
Monitor process telemetry for ack launches from repository working directories and correlate with memory pressure events
Log the introduction of new .ackrc files during pull requests and treat them as configuration changes requiring review

How to Mitigate CVE-2026-49146

Immediate Actions Required

Upgrade App::Ack to version 3.10.0 or later on all systems where ack is installed
Review existing repositories for untrusted .ackrc files and remove or sanitize any with excessive context values
Instruct developers not to run ack inside freshly cloned untrusted repositories until the upgrade is applied

Patch Information

The fix is included in App::Ack v3.10.0, released by the beyondgrep/ack3 maintainers. The upstream commit 45ff5fe77dbd96f7332f31943102291f878f30b8 adds bounded validation and a new regression test t/invalid-context.t. Refer to the ack3 patch commit, the MetaCPAN release notes for ack v3.10.0, and the OpenWall OSS-Security advisory.

Workarounds

Disable project-level .ackrc loading by invoking ack --noenv when scanning untrusted repositories
Set a strict ulimit -v on shells and CI jobs that execute ack to cap virtual memory allocations
Delete or rename any .ackrc file present in an untrusted working directory before running ack

bash

# Configuration example: run ack safely against untrusted repositories
# 1. Ignore any project .ackrc while auditing external code
ack --noenv 'pattern' /path/to/untrusted/repo

# 2. Cap virtual memory for CI shells that invoke ack
ulimit -v 1048576   # 1 GiB address-space limit

# 3. Verify the installed ack version is patched
ack --version | head -n1   # expect: ack v3.10.0 or later