CVE-2026-107794

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107794
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107794.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107794
Downstream
Published
2026-10-10T12:45:19Z
Modified
2026-10-12T02:31:21Z
Summary
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
Details

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.

The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.

Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.

Database specific 
{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-191"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107794.json"
}
References

Affected packages

Git / github.com/tsee/extutils-typemap-default

Affected ranges

Type
GIT
Repo
https://github.com/tsee/extutils-typemap-default
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6e24166f27fe22e5b239ef7ac95b829f3acd16e8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.07"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

ExtUtils-Typemap-Default-0.*
ExtUtils-Typemap-Default-0.01
ExtUtils-Typemap-Default-0.02
ExtUtils-Typemap-Default-0.03
ExtUtils-Typemap-Default-0.04
ExtUtils-Typemap-Default-0.05
ExtUtils-Typemap-Default-0.06
ExtUtils-Typemaps-Default-1.*
ExtUtils-Typemaps-Default-1.00
ExtUtils-Typemaps-Default-1.01
ExtUtils-Typemaps-Default-1.03
ExtUtils-Typemaps-Default-1.04
ExtUtils-Typemaps-Default-1.05
ExtUtils-Typemaps-Default-1.06

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107794.json"