CVE-2026-107794
Received Received - Intake

Memory Exhaustion in ExtUtils::Typemaps::STL::List

Publication date: 2026-10-10

Last updated on: 2026-10-10

Assigner: CPANSec

Description
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-10
Last Modified
2026-10-10
Generated
2026-10-10
AI Q&A
2026-10-10
EPSS Evaluated
N/A
NVD
CVE-2026-107794
EUVD
EUVD-2026-96315

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects ExtUtils::Typemaps::STL::List versions before 1.07 for Perl. When an empty list is processed, the code incorrectly allocates a 32 GiB array due to an integer underflow in the av_extend function. This leads to memory exhaustion and potential system instability.

Detection Guidance

This vulnerability is specific to Perl's ExtUtils::Typemaps::STL::List module and may not have direct network detection methods. Check Perl module versions with commands like 'cpan ExtUtils::Typemaps::STL::List' or inspect installed modules via 'perl -MCPAN -e "print CPAN::Shell->expand("Module", "ExtUtils::Typemaps::STL::List")->inst_version". If version is below 1.07, the system is vulnerable.

Impact Analysis

This vulnerability can cause your system to run out of memory, leading to crashes or denial of service. It specifically affects Perl applications using vulnerable versions of ExtUtils::Typemaps::STL::List when processing empty lists.

Mitigation Strategies

Update the ExtUtils::Typemaps::STL::List module to version 1.07 or later using CPAN: 'cpan ExtUtils::Typemaps::STL::List'. Alternatively, remove or replace the module if not required. Monitor system memory usage for signs of exhaustion during Perl operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107794. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart