EUVD-2026-96315
GHSA-h5wv-6qvp-x98v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend input to XS-backed endpoint
-
ExploitForce empty std::list return value
-
ExecutionTrigger av_extend(av,-1) integer underflow
-
ImpactAllocate 2^32 slots and exhaust memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer underflow checks
|
| Exploitation Conditions | Requires an application or XS module compiled against ExtUtils::Typemaps::STL::List before 1.07 that uses the OUTPUT typemap to convert a C++ std::list into a Perl array, AND a reachable code path where that list is empty - the typemap then calls av_extend(av, len-1), i.e. av_extend(av, -1), which underflows to request a 2^32-element (~32 GiB) allocation. Limiting factors that reduce real risk: the vulnerable typemap must actually be in use (non-default dependency), the attacker must be able to drive the function to an empty-list result, and the impact is confined to availability (process crash / memory exhaustion) with no code execution, data exposure, or integrity loss. A similar defect was already fixed in ExtUtils::Typemaps::STL::Vector 1.05, confirming the root cause class. |
| Impact | The CVSS 7.5 (HIGH) score is driven exclusively by availability impact (A:H) from memory exhaustion - the vector explicitly sets C:N/I:N, meaning there is NO confidentiality or integrity impact. This directly contradicts the 'Information Disclosure' tag in the input, which appears mislabeled; the real impact is denial of service only. Exploitation signals are weak: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified. While the CVSS vector claims AV:N/AC:L/PR:N/UI:N (network, low-complexity, unauthenticated), real-world exploitability is heavily gated - the flaw lives in generated XS typemap code, so it is only reachable if an application was compiled against ExtUtils::Typemaps::STL::List <1.07 AND an attacker can force an empty std::list to be returned through the OUTPUT typemap. Net assessment: this is a high-CVSS-but-low-real-risk issue. The availability-only impact, extremely low EPSS, absence of KEV/POC, and niche developer-library footprint make it a low operational priority (patch during routine maintenance) rather than an urgent threat. The AV:N rating is optimistic and application-dependent - verify whether any exposed service actually routes attacker input into this typemap. |
| Exploit ScenarioDerived | An application built with ExtUtils::Typemaps::STL::List (<1.07) exposes an XS function that returns a std::list via the OUTPUT typemap. An attacker supplies input that causes the function to return an empty list, triggering av_extend(av, len-1) = av_extend(av, -1); the length underflows and Perl attempts to allocate a 2^32-slot (~32 GiB) array, exhausting memory and crashing the process. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Memory exhaustion in Perl's ExtUtils::Typemaps::STL::List before version 1.07 allows remote attackers to cause a denial of service via an empty list processed by the OUTPUT typemap, which triggers an integer underflow and a ~32 GiB allocation. This high-severity availability-only vulnerability (CVSS 7.5, C:N/I:N/A:H) requires a compiled XS module that uses the vulnerable typemap and a reachable code path with an empty list. No public exploit code has been identified at time of analysis, and the EPSS score is low (0.18%, percentile 7%).
RemediationAI
Vendor-released patch: upgrade ExtUtils::Typemaps::STL::List to version 1.07 or later, which is included in the ExtUtils-Typemaps-Default 1.07 release (https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.07/changes). After upgrading, any XS modules that were compiled against the vulnerable typemap must be recompiled to incorporate the fix. If an immediate upgrade is not possible, module authors can manually patch the typemap to check for an empty list before calling av_extend (e.g., adding a conditional to avoid len-1 when len=0), but this requires code changes and recompilation. No runtime workaround exists for end-users; the vulnerability is only exploitable when the compiled typemap is used with an empty list. For further information, consult the advisory at https://seclists.org/oss-sec/2026/q4/131 and the CPAN bug tracker at https://rt.cpan.org/Public/Bug/Display.html?id=91213.
Affected ProductsAI
Perl module ExtUtils::Typemaps::STL::List versions before 1.07 are affected. The module is part of the ExtUtils-Typemaps-Default distribution; the fix is included in release 1.07 (see https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.07/changes). The related Vector typemap was patched in version 1.05. CPE strings are not provided in the available data, but the affected component is the List OUTPUT typemap used for converting std::list to Perl arrays. Additional details are available in the CPAN RT ticket https://rt.cpan.org/Public/Bug/Display.html?id=91213 and the oss-security advisory https://seclists.org/oss-sec/2026/q4/131.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the Perl XS typemap ExtUtils::Typemaps::STL::List, which converts C++ std::list objects into Perl arrays when building XS modules. The OUTPUT typemap calls av_extend(av, len-1); when the list is empty (len=0), len-1 underflows to a huge value, causing av_extend to allocate an array with 2^32 slots (~32 GiB), exhausting memory. This is a classic integer underflow (CWE-191). The defect is fixed in version 1.07 of the distribution ExtUtils::Typemaps::Default. A similar flaw was previously addressed in ExtUtils::Typemaps::STL::Vector version 1.05, confirming the root cause class. Affected systems are those built with the vulnerable typemap; no confidentiality or integrity impact is present, only availability.
Know when Perl gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Empty-list underflow fires automatically with no auth or interaction; impact is memory-exhaustion DoS only, hence C:N/I:N/A:H; AV:N retained but is application-exposure dependent.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.
The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.
Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.
Executive ViewAI
Perl's ExtUtils::Typemaps::STL::List versions before 1.07 can be forced to exhaust memory via an empty-list handling flaw, causing a denial of service in affected Perl applications that compile and expose XS modules using the vulnerable typemap. Because exploitation requires a reachable code path that processes an empty list, only a subset of Perl services is likely affected, but any impacted service could become unavailable. Leadership should prioritize inventory and mitigation because no public exploit is identified at this time and no vendor patch is available, making proactive controls the primary defense.
No vendor patch available; use process memory limits (ulimit/cgroups), enforce input validation to reject empty lists before typemap processing, restrict network exposure of affected Perl services, monitor for large memory allocations, and apply vendor update when released (target 1.07 or later).
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly hand
Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before
The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of
Perl before 5.26.3 has a buffer overflow via a crafted regular expression that triggers invalid write operations. Rated
Perl before 5.26.3 and 5.28.0 before 5.28.1 has a buffer overflow via a crafted regular expression that triggers invalid
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive informa
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate e
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. Rated high severity (CVS
The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval, which mig
In Perl through 5.26.2, the Archive::Tar module allows remote attackers to bypass a directory-traversal protection mecha
Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression quantifiers
The (1) S_reghop3, (2) S_reghop4, and (3) S_reghopmaybe3 functions in regexec.c in Perl before 5.24.0 allow context-depe
Exploit-DB