CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.
The OUTPUT typemaps call avextend( av, len-1 ). On an empty list, this undeflows, and avextend will allocate an array with 2^32 slots, leading to memory exhaustion.
Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ExtUtils::Typemaps::Defaultto a version that resolves this vulnerability.Fixed in 1.07 - Operational
Rebuild any modules that use ExtUtils::Typemaps::Default as part of their build process
Event History
Frequently Asked Questions
What input triggers the excessive memory allocation?
The condition is triggered when the affected OUTPUT typemaps process an empty list. They call av_extend(av, len-1), and the zero length causes an integer underflow that requests an array with 2^32 slots.
Which versions need remediation?
Versions before 1.07 are affected. Upgrade ExtUtils::Typemaps::STL::List to version 1.07 or later.
What is the practical impact of successful triggering?
The attempted allocation is approximately 32 GiB, which can exhaust available memory and cause a denial of service.