CVE-2026-16634: TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99.
The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker.
Any caller that passes untrusted TOML to fromtoml risks a stack overflow from a deeply-nested document.
TOML::XS version 0.06 or later uses the successor tomlc17 library.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl TOML::XSto a version that resolves this vulnerability.Fixed in 0.06Patch CVE-2026-16634
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16634?
CVE-2026-16634 has a severity rating of critical with a score of 9.8.
How do I fix CVE-2026-16634?
To fix CVE-2026-16634, upgrade to TOML::XS version 0.06 or later.
What vulnerability is associated with CVE-2026-16634?
CVE-2026-16634 is associated with an uncontrolled recursion vulnerability in the tomlc99 library.
What impact does CVE-2026-16634 have on my application?
CVE-2026-16634 can lead to stack overflow when untrusted TOML is passed to from_toml.
Why is tomlc99 a concern in CVE-2026-16634?
Tomlc99 is a concern in CVE-2026-16634 because it is no longer maintained and contains a known vulnerability.