EUVD-2026-59988Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Class resolution occurs before signature verification so no valid credentials are required; POST body path imposes no key-length bounds enabling full availability impact.
Primary rating from Vendor (9b29abf9-4ab0-4765-b253-1875cd9b441e).
CVSS VectorVendor: 9b29abf9-4ab0-4765-b253-1875cd9b441e
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4DescriptionCVE.org
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require.
smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked.
A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.
AnalysisAI
Memory exhaustion in Net::OAuth before version 0.32 for Perl allows remote attackers to crash persistent server worker processes by flooding an OAuth endpoint with requests carrying arbitrary or malformed signature_method values via POST body. The smart_require function writes every attempted module-load result - including failures - into an unbounded process-global hash keyed on attacker-controlled class names, and because verify resolves the signature method class before any OAuth signature is checked, no valid credentials are required to trigger the write path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is triggered when a persistent Perl server process running Net::OAuth before 0.32 receives an OAuth request that causes `verify` to be called - this occurs before any signature validation, so no valid OAuth client credentials or correctly signed request is required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (6.5 Medium) is directionally reasonable but the PR:L assignment deserves scrutiny: the description and commit diff both confirm that class resolution occurs inside `verify` before any OAuth signature is validated, meaning a syntactically plausible but unsigned or forged OAuth POST body is sufficient to trigger the cache write - behavior that aligns more closely with PR:N than PR:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a continuous stream of HTTP POST requests to a Net::OAuth-protected endpoint, each containing a unique, arbitrarily long `signature_method` value in the POST body rather than the Authorization header, bypassing any header-size enforcement at the proxy layer. Each request causes `smart_require` to attempt a Perl `require` on an attacker-constructed class name, fail, and cache that failure permanently in `%ALREADY_REQUIRED`; the Perl worker process accumulates heap entries for the lifetime of the process until it is killed by the OS OOM killer or exhausts swap. … |
| Remediation | Upgrade Net::OAuth to version 0.32 or later via CPAN using `cpanm Net::OAuth` or `cpan -i Net::OAuth`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today