CVE-2026-49146: App::Ack Memory Exhaustion via Malicious .ackrc Configuration

Technical summary

App::Ack fails to enforce reasonable limits on the -B (before-context) and -C (context) command-line options when they are specified in a project .ackrc file. The application constructs in-memory buffers sized directly to the user-supplied integer value without validation or upper bounds enforcement. A .ackrc containing --before-context=100000000 will instantiate a buffer with 100 million elements, consuming gigabytes of RAM. Since ack searches parent directories for .ackrc files and loads them automatically, an attacker placing a malicious .ackrc in a Git repository or shared project directory can trigger memory exhaustion in any user who runs ack within that directory tree. The resulting out-of-memory condition terminates the process ungracefully. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

Business impact

For development teams and security researchers who rely on ack for code searching and auditing, this vulnerability can disrupt workflow and automation. In CI/CD pipelines or security scanning workflows that invoke ack, a malicious repository could cause pipeline jobs to fail or hang. Supply chain risk is elevated if developers pull code from untrusted sources—the mere act of running ack on a cloned repository could crash their tools. While availability impact is the primary concern (denial of service rather than data exfiltration), the ease of exploitation and low barrier to deployment in open-source projects make this a practical attack vector against development infrastructure.

Affected systems

The vulnerability affects App::Ack versions before 3.10.0. Users running ack from Perl package repositories or distributions should verify their installed version. The vulnerability is triggered when a user executes ack within a directory that contains (or whose parent directories contain) a malicious .ackrc file, making any development environment that uses ack on untrusted or mixed-source repositories potentially at risk.

Exploitability

Exploitation requires no authentication, no user interaction beyond normal ack usage, and no special privileges. The attack is highly practical: an attacker commits a .ackrc file to a public or internal repository with a malicious context value. When developers clone the repository and run ack—a common action during code review, debugging, or security analysis—the application crashes. The CVSS score of 7.5 (HIGH) reflects the network-adjacent attack surface, low complexity, and guaranteed availability impact. The exploit is deterministic and not dependent on race conditions or specific system configurations.

Remediation

Upgrade App::Ack to version 3.10.0 or later. The patched version should include validation that enforces reasonable upper bounds on context buffer sizes, preventing unbounded memory allocation. Users unable to upgrade immediately should avoid running ack on directories from untrusted sources or implement wrapper scripts that sanitize or reject .ackrc files with excessive context values. Organizations deploying ack in CI/CD environments should pin the tool version and implement pre-commit hooks that validate .ackrc files for suspicious configuration values.

Patch guidance

Check your current version of App::Ack using `ack --version`. If the version is below 3.10.0, apply the update through your Perl package manager (CPAN, apt, yum, homebrew, or equivalent). For Perl installations, use `cpan -i App::Ack` or `perl -MCPAN -e 'install App::Ack'` and verify the installation completes to version 3.10.0 or later. In containerized or CI/CD environments, update the Dockerfile or dependency manifest to specify `App::Ack >= 3.10.0`. After patching, verify the new version is in use before resuming ack operations on repositories of uncertain provenance.

Detection guidance

Monitor for ack process crashes or out-of-memory errors in logs, particularly in development or CI/CD environments. If you maintain a repository or project, audit your .ackrc file for context values larger than a few thousand lines; typical use cases rarely require context buffers exceeding 1000 lines. If you suspect a malicious .ackrc in a repository, inspect the file before running ack or disable automatic .ackrc loading by removing the file or using ack's command-line options to override it. Automated scanning of committed .ackrc files for suspiciously large integer values can catch malicious commits before they affect developers.

Why prioritize this

Although this is a denial-of-service vulnerability rather than code execution or data breach, it scores HIGH due to the trivial attack complexity, complete lack of authentication barriers, and practical deployability in supply-chain scenarios. The automatic loading of .ackrc from repositories means developers cannot easily avoid the attack without explicit awareness. Patching is straightforward and low-risk, making immediate remediation the best course of action for teams using ack in automated workflows or on shared/external repositories.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: (1) Network-adjacent attack vector via repository commit, (2) Low attack complexity—no special conditions needed, (3) No privileges required and no user interaction beyond normal ack usage, (4) Impact scoped to the attacked system (ack process), and (5) High availability impact (guaranteed crash and resource exhaustion). The score does not reflect confidentiality or integrity impact because the vulnerability causes denial of service only. The absence of KEV listing indicates no evidence of active exploitation in the wild as of the publication date, but the ease of exploitation means defensive patching should not wait for real-world incidents.

Frequently asked questions