Executive brief
App::Ack (commonly known as 'ack') is a code-searching tool similar to grep. A vulnerability exists where the tool can be forced to crash or consume excessive system memory when searching within a directory containing a specially crafted configuration file. This could be used by an attacker to disrupt developer workflows or cause a denial-of-service on systems where automated searches are performed on untrusted code repositories.
Technical details
App::Ack (ack) before version 3.10.0 is vulnerable to resource exhaustion (CWE-770). The tool automatically searches for and loads configuration options from '.ackrc' files in the directory hierarchy. The '-B' (before-context) and '-C' (context) options failed to validate the upper bounds of integer values. An attacker can place a crafted '.ackrc' file in a repository with an extremely large context value (e.g., 100,000,000), causing ack to attempt a massive memory allocation for the context buffer when executed in that directory. This results in an out-of-memory (OOM) condition and process termination. The issue is fixed in version 3.10.0 by capping context values at 10,000.
Affected products
- PETDANCE App::Ack (ack) < 3.10.0
Timeline
- 2026-06-07: patched: Fix committed to repository
- 2026-07-08: disclosed: CVE-2026-49146 published