EUVD-2026-48547
GHSA-hr7v-gv37-xpx2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e) · only source for this CVE.
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
Lifecycle Timeline
5DescriptionCVE.org
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99.
The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker.
Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.
TOML::XS version 0.06 or later uses the successor tomlc17 library.
AnalysisAI
Stack overflow vulnerability in Perl module TOML::XS versions prior to 0.06 stems from an uncontrolled recursion flaw in the bundled, unmaintained tomlc99 library. An unauthenticated remote attacker can cause denial of service or potentially achieve arbitrary code execution by sending a deeply nested TOML document to any application using from_toml to parse untrusted input. No active exploitation or public exploit code has been identified, but the flaw is easily reachable over the network.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today