CVE-2026-72888
Received Received - Intake

Memory Exhaustion in Net::OAuth Perl Module

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: CPANSec

Description
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked. A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-72888
EUVD
EUVD-2026-59988

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
net_oauth net_oauth to 0.32 (exc)
vurtdev net_oauth to 0.32 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory exhaustion issue in Net::OAuth versions before 0.32 for Perl. The smart_require function caches failed class name lookups in a global hash without limits. Attackers can exploit this by sending requests with distinct, large signature method names, causing the cache to grow indefinitely and exhaust memory before signature verification.

Detection Guidance

Monitor memory usage of Perl applications using Net::OAuth, particularly in persistent environments like mod_perl or Starman. Check for processes with rapidly increasing memory consumption. Use tools like top, htop, or ps to observe memory growth patterns. Examine logs for repeated failed class load attempts in Net::OAuth::smart_require.

Impact Analysis

An attacker can cause a denial of service by triggering memory exhaustion in a server using vulnerable Net::OAuth versions. This is especially severe in persistent environments like mod_perl or Starman, where memory usage grows until the process crashes or is killed by the system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a memory exhaustion issue in a Perl module rather than a data protection or privacy breach. However, if exploited in a system handling sensitive data, it could lead to service disruption, which may indirectly impact compliance with availability requirements in regulations like GDPR or HIPAA.

Mitigation Strategies

Upgrade Net::OAuth to version 0.32 or later. If upgrading is not immediately possible, implement input validation to restrict signature method names to a predefined list before processing. Restart persistent Perl processes to clear the existing cache. Consider disabling persistent environments if they are not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72888. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart