diff --git a/re.c b/re.c
index 70194be87e..89910f67b4 100644
--- a/re.c
+++ b/re.c
@@ -1235,6 +1235,7 @@ match_set_string(VALUE m, VALUE string, long pos, long len)
     rmatch->regs.beg[0] = pos;
     rmatch->regs.end[0] = pos + len;
     rmatch->char_offset_updated = 0;
+    OBJ_INFECT(match, string);
 }
 
 void
diff --git a/string.c b/string.c
index 8b5c1f6530..46cccac6e8 100644
--- a/string.c
+++ b/string.c
@@ -3895,8 +3895,11 @@ rb_pat_search(VALUE pat, VALUE str, long pos, int set_backref_str)
 	pos = rb_str_index(str, pat, pos);
 	if (set_backref_str) {
 	    if (pos >= 0) {
+		VALUE match;
 		str = rb_str_new_frozen(str);
 		rb_backref_set_string(str, pos, RSTRING_LEN(pat));
+		match = rb_backref_get();
+		OBJ_INFECT(match, pat);
 	    }
 	    else {
 		rb_backref_set(Qnil);
diff --git a/test/ruby/test_string.rb b/test/ruby/test_string.rb
index 5ee026c327..a35f6a3bb7 100644
--- a/test/ruby/test_string.rb
+++ b/test/ruby/test_string.rb
@@ -1156,6 +1156,8 @@ class TestString < Test::Unit::TestCase
     /h/ =~ a
     a.scan('x')
     assert_nil($~)
+
+    assert_equal(3, S("hello hello hello").scan("hello".taint).count(&:tainted?))
   end
 
   def test_size