CVE-2013-10076: ExtUtils::Typemaps::STL::Vector DoS Vulnerability

CVE-2013-10076 Overview

CVE-2013-10076 is an integer underflow vulnerability in the Perl module ExtUtils::Typemaps::STL::Vector prior to version 1.05. The OUTPUT typemap calls av_extend(av, len-1) without checking whether len is zero. When an empty std::vector is passed, the unsigned subtraction underflows, causing av_extend to allocate an array with 2^32 slots. This triggers memory exhaustion, consuming roughly 32 GiB and leading to denial of service for the affected Perl process. The flaw is classified under [CWE-191: Integer Underflow (Wrap or Wraparound)].

Critical Impact
An attacker who can reach a Perl XS binding that returns an empty STL vector can exhaust system memory and crash the host process.

Affected Products

ExtUtils::Typemaps::Default distribution on CPAN
ExtUtils::Typemaps::STL::Vector module versions prior to 1.05
Any Perl XS extension generated from the vulnerable STL vector OUTPUT typemaps

Discovery Timeline

2026-10-10 - CVE-2013-10076 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2013-10076

Vulnerability Analysis

The vulnerability resides in the OUTPUT typemap code emitted by ExtUtils::Typemaps::STL::Vector. When Perl XS glue code converts a C++ std::vector to a Perl array (AV), the typemap pre-allocates storage using av_extend(av, len-1). The len variable is declared as const unsigned int and holds $var.size(). If the returned vector is empty, len equals zero, and len-1 wraps around to 0xFFFFFFFF.

Perl's av_extend interprets this value as the highest index to accommodate and attempts to allocate storage for 2^32 scalar pointer slots. On a 64-bit system, this requires approximately 32 GiB of contiguous memory, which almost always triggers an out-of-memory condition and process termination.

Root Cause

The root cause is an unchecked unsigned integer underflow. The typemap author assumed a non-empty vector but omitted a zero-length guard before computing len-1. Because len is unsigned, the compiler does not raise a signed-underflow signal; the wraparound silently produces the maximum 32-bit value.

Attack Vector

Any code path that exposes a Perl XS function returning an empty STL vector reaches the vulnerable allocation. Network-facing Perl services that process attacker-controlled input and return STL vector results can be forced into the empty-return branch, triggering remote memory exhaustion without authentication or user interaction.

text

// Patch to lib/ExtUtils/Typemaps/STL/Vector.pm
 AV* av = newAV();
 $arg = newRV_noinc((SV*)av);
 const unsigned int len = $var.size();
-av_extend(av, len-1);
+if (len)
+  av_extend(av, len-1);
 for (unsigned int i = 0; i < len; i++) {
   av_store(av, i, newSV!SHORTTYPELC!v(${var}[i]));
 }
// Source: https://github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934.patch

The patch adds an if (len) guard that skips the av_extend call when the vector is empty, eliminating the underflow.

Detection Methods for CVE-2013-10076

Indicators of Compromise

Perl processes abruptly terminated by the OOM killer with resident set sizes approaching 32 GiB.
Kernel logs (dmesg, /var/log/messages) containing Out of memory: Killed process entries referencing perl or an XS-based daemon.
Repeated short-lived requests to a Perl endpoint immediately followed by process restarts or worker crashes.

Detection Strategies

Inventory CPAN modules on build and production hosts and flag any ExtUtils-Typemaps-Default release below 1.05.
Static-scan XS source for the pattern av_extend(av, len-1) without a preceding length check.
Correlate web or RPC error spikes with host memory pressure metrics to surface exploitation attempts.

Monitoring Recommendations

Alert on sudden memory allocation jumps above a per-process baseline for Perl workers.
Track OOM-killer events and tie them to the originating service and request identifier.
Monitor cgroup or systemd MemoryMax violations for Perl services to catch exhaustion attempts early.

How to Mitigate CVE-2013-10076

Immediate Actions Required

Upgrade ExtUtils::Typemaps::Default to version 1.05 or later on all build systems and rebuild any XS extensions that embed the generated typemap code.
Audit production Perl deployments for XS modules compiled against the vulnerable typemap and redeploy them after patching.
Enforce per-process memory limits on Perl services to contain exploitation while patches propagate.

Patch Information

The fix was committed in the upstream repository and released as ExtUtils-Typemaps-Default-1.05. Review the GitHub commit patch, the MetaCPAN release changes, and CPAN Bug Report #91213 for the authoritative references.

Workarounds

Patch locally generated typemap code to wrap av_extend(av, len-1) with an if (len) guard, matching the upstream fix.
Constrain Perl worker memory with ulimit -v, systemd MemoryMax, or container memory limits to bound the impact of an underflow.
Validate inputs to any XS binding so empty-vector return paths are not reachable by untrusted callers until patched builds are deployed.

bash

# Upgrade the vulnerable module and rebuild dependent XS extensions
cpanm ExtUtils::Typemaps::Default@1.05

# Enforce a memory ceiling for Perl workers under systemd
sudo systemctl set-property my-perl-service.service MemoryMax=2G

# Verify the installed version
perl -MExtUtils::Typemaps::Default -e 'print $ExtUtils::Typemaps::Default::VERSION, "\n"'