CVE-2026-107794 Overview
CVE-2026-107794 affects ExtUtils::Typemaps::STL::List versions before 1.07 for Perl. The module allocates a 32 GiB array when processing an empty list, enabling a remote denial-of-service condition. The flaw stems from an integer underflow [CWE-191] in the OUTPUT typemap, which calls av_extend(av, len-1) without validating that len is greater than zero. When len equals zero, the subtraction underflows and causes av_extend to allocate an array with 2^32 slots, exhausting process memory.
Critical Impact
Attackers can trigger memory exhaustion in Perl applications that use affected typemaps to return empty STL list results, leading to process termination and service disruption.
Affected Products
- ExtUtils::Typemaps::STL::List versions prior to 1.07
- Perl applications using ExtUtils::Typemaps::Default prior to 1.07
- Related: ExtUtils::Typemaps::STL::Vector prior to 1.05 (previously patched)
Discovery Timeline
- 2026-10-10 - CVE-2026-107794 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-107794
Vulnerability Analysis
The vulnerability resides in the OUTPUT typemap logic that converts C++ STL list objects into Perl arrays. The typemap invokes av_extend(av, len-1) to pre-allocate storage for the result array. The len parameter represents the size of the source STL container as an unsigned integer.
When the source list is empty, len equals zero. Subtracting one from an unsigned zero wraps to the maximum unsigned value. The Perl internal function av_extend then interprets this value as a requested capacity and attempts to allocate approximately 32 GiB of memory for 2^32 array slots.
The allocation fails on most systems or consumes available memory, terminating the Perl process. A nearly identical defect was previously patched in ExtUtils::Typemaps::STL::Vector version 1.05, confirming the pattern across STL container typemaps shipped by the module.
Root Cause
The root cause is an integer underflow in unsigned arithmetic. The typemap author assumed len would always be non-zero, omitting the boundary check required before decrementing. CWE-191 (Integer Underflow) classifies this class of error, where arithmetic on unsigned values produces an unexpectedly large result instead of a negative number.
Attack Vector
Exploitation requires an application to call Perl XS code that returns an empty STL list through the vulnerable typemap. Any network-exposed service that invokes such bindings on attacker-controlled input can be forced into memory exhaustion. No authentication or user interaction is required. The vulnerability affects availability only; it does not expose data or permit code execution.
The vulnerability is described in prose because no verified public exploit code is available. See the MetaCPAN Release Changes and CPAN Bug Report #91213 for upstream technical details.
Detection Methods for CVE-2026-107794
Indicators of Compromise
- Perl processes terminated by the OOM killer with resident memory approaching 32 GiB
- Repeated service crashes immediately following requests that produce empty result sets
- Kernel log entries referencing perl as the killed process shortly after XS boundary calls
Detection Strategies
- Inventory installed CPAN modules and flag hosts running ExtUtils::Typemaps::Default below version 1.07
- Review XS bindings for OUTPUT typemaps that call av_extend without validating container length
- Correlate application error logs for Out of memory exceptions originating from Perl worker processes
Monitoring Recommendations
- Alert on sudden memory allocation spikes in Perl processes exceeding baseline by multiple gigabytes
- Monitor OOM killer events on hosts running Perl-based services and web applications
- Track process restart frequency for Perl workers to identify repeated denial-of-service attempts
How to Mitigate CVE-2026-107794
Immediate Actions Required
- Upgrade ExtUtils::Typemaps::Default to version 1.07 or later across all development and production systems
- Rebuild any Perl XS modules that were compiled against affected typemaps so the fixed logic is embedded in generated C code
- Audit custom typemaps for similar av_extend(av, len-1) patterns and apply equivalent length validation
Patch Information
The fix ships in ExtUtils::Typemaps::Default version 1.07, available from CPAN. The release notes documenting the correction are published at the MetaCPAN Release Changes page. The companion ExtUtils::Typemaps::STL::Vector fix was previously released in version 1.05 and addresses the same underflow pattern.
Workarounds
- Set per-process memory limits using ulimit -v or systemd MemoryMax to contain exhaustion attempts
- Patch generated XS C code to add an explicit if (len > 0) guard around calls to av_extend
- Restrict network inputs that can produce empty STL list results until the module upgrade is deployed
# Upgrade the vulnerable module from CPAN
cpanm ExtUtils::Typemaps::Default@1.07
# Verify the installed version
perl -MExtUtils::Typemaps::Default -e 'print $ExtUtils::Typemaps::Default::VERSION, "\n"'
# Rebuild dependent XS modules
cpanm --reinstall <your-xs-module>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
