CVE-2013-10076: ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list

Q: What conditions are required to trigger the memory exhaustion?

The vulnerable OUTPUT typemap must process an empty list. In affected versions, the empty length is decremented before being passed to av_extend, causing an integer underflow and an attempted allocation of 2^32 array slots.

Q: Which deployments should be prioritized for remediation?

Prioritize systems using ExtUtils::Typemaps::STL::Vector before version 1.05 where untrusted or attacker-influenced input can cause an empty list to be converted through the affected OUTPUT typemap. The provided information does not establish whether this is reachable in a default application configuration.

Q: What is the available fix?

Upgrade ExtUtils::Typemaps::STL::Vector to version 1.05 or later. Version 1.05 is identified as the release that addresses the empty-list allocation behavior.

Published Oct 10, 2026

Updated

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list.

The OUTPUT typemaps call avextend( av, len-1 ). On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion.

Affected Software

1 affected component

cpan/ExtUtils-Typemaps-STL-Vector<1.05

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ExtUtils::Typemaps::Default to a version that resolves this vulnerability.
Fixed in 1.07
Operational
Rebuild any modules that use ExtUtils::Typemaps::Default as part of their build process.

Event History

Oct 10, 2026

CVE Published

via MITRE·12:44 PM

Data Sourced

via MITRE·12:44 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·01:17 PM

DescriptionWeakness

Frequently Asked Questions

What conditions are required to trigger the memory exhaustion?

The vulnerable OUTPUT typemap must process an empty list. In affected versions, the empty length is decremented before being passed to av_extend, causing an integer underflow and an attempted allocation of 2^32 array slots.

Which deployments should be prioritized for remediation?

Prioritize systems using ExtUtils::Typemaps::STL::Vector before version 1.05 where untrusted or attacker-influenced input can cause an empty list to be converted through the affected OUTPUT typemap. The provided information does not establish whether this is reachable in a default application configuration.

What is the available fix?

Upgrade ExtUtils::Typemaps::STL::Vector to version 1.05 or later. Version 1.05 is identified as the release that addresses the empty-list allocation behavior.

CVE-2013-10076: ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are required to trigger the memory exhaustion?

Which deployments should be prioritized for remediation?

What is the available fix?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required to trigger the memory exhaustion?

Which deployments should be prioritized for remediation?

What is the available fix?