CVE-2026-16634: TOML::XS for Perl DoS Vulnerability

CVE-2026-16634 Overview

CVE-2026-16634 affects TOML::XS versions before 0.06, a Perl binding for parsing Tom's Obvious Minimal Language (TOML) documents. The module bundles an unsupported version of the tomlc99 library, which contains a publicly disclosed uncontrolled recursion flaw [CWE-1104]. Any caller that passes untrusted TOML input to the from_toml function risks a stack overflow when parsing deeply-nested documents. The maintainer resolved the issue in TOML::XS 0.06 by migrating to the successor tomlc17 library.

Critical Impact
Remote attackers can trigger a stack overflow and denial of service by supplying a crafted TOML document with excessive nesting to any Perl application using TOML::XS before 0.06.

Affected Products

TOML::XS for Perl, versions prior to 0.06
Bundled tomlc99 library (unmaintained)
Perl applications invoking from_toml on untrusted input

Discovery Timeline

2026-07-24 - CVE-2026-16634 published to the National Vulnerability Database (NVD)
2026-07-24 - Advisory posted to the Openwall OSS-Security Mailing List
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-16634

Vulnerability Analysis

TOML::XS is an XS-based Perl module that wraps a C library for high-performance TOML parsing. Versions before 0.06 bundle tomlc99, a C library that is no longer maintained. The bundled parser uses recursive descent to process nested tables and arrays without enforcing a depth limit.

When an attacker supplies a TOML document containing deeply nested structures, each nesting level consumes a new stack frame. Once the process stack is exhausted, the parser triggers a stack overflow and the host process terminates. The issue is tracked publicly in the tomlc99 issue tracker.

Applications exposing TOML parsing to network input, such as configuration upload endpoints, package metadata handlers, or webhook processors, are the primary risk surface.

Root Cause

The root cause is the use of an unmaintained third-party component [CWE-1104]. The tomlc99 recursive parser does not bound recursion depth when consuming nested tables or arrays. TOML::XS statically bundled this parser, propagating the flaw to every downstream Perl consumer.

Attack Vector

Exploitation requires no authentication, no user interaction, and can be triggered remotely by any input path that reaches from_toml. An attacker constructs a small TOML payload with thousands of nested arrays or inline tables and delivers it via HTTP, message queue, or file upload. The resulting stack overflow crashes the Perl process, causing denial of service. See the TOML specification for the language constructs abused during exploitation.

No verified public exploit code is documented for this CVE. The vulnerability mechanism is described in the tomlc99 issue discussion.

Detection Methods for CVE-2026-16634

Indicators of Compromise

Perl worker processes terminating with SIGSEGV shortly after receiving TOML input
Sudden process restarts or crash-loop behavior in services that parse configuration or user-supplied TOML
Web access logs containing requests with unusually large sequences of [[, {, or [ characters in TOML bodies

Detection Strategies

Inventory Perl dependencies with cpan -l or cpanm --info TOML::XS to identify installations older than 0.06
Inspect vendored or static builds for the string tomlc99 in shared objects and archives
Add application-layer input size and nesting-depth checks to any endpoint that accepts TOML

Monitoring Recommendations

Alert on repeated segmentation faults from Perl interpreters using host telemetry and audit logs
Monitor request bodies to TOML-consuming endpoints for anomalous bracket or brace repetition counts
Track dependency drift with software composition analysis to flag reintroduction of tomlc99

How to Mitigate CVE-2026-16634

Immediate Actions Required

Upgrade TOML::XS to version 0.06 or later, which replaces tomlc99 with tomlc17
Audit all Perl services for direct or transitive dependency on TOML::XS and rebuild affected artifacts
Restrict or authenticate network endpoints that pass externally supplied TOML to from_toml

Patch Information

The maintainer released TOML::XS 0.06 to address the vulnerability. Release notes are available at the MetaCPAN Release Changes page. The updated module uses the tomlc17 library, which is actively maintained and enforces safer parsing behavior.

Workarounds

Reject TOML inputs above a conservative size threshold before invoking from_toml
Pre-validate nesting depth with a lightweight scanner that counts unmatched [ and { tokens
Isolate TOML parsing in a sandboxed worker process with a constrained stack size and automatic restart

bash

# Upgrade TOML::XS to the patched release
cpanm TOML::XS@0.06

# Verify installed version
perl -MTOML::XS -e 'print $TOML::XS::VERSION, "\n"'