CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 9949

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

CVE-2026-107794 affects ExtUtils::Typemaps::STL::List versions before 1.07 for Perl, which allocates a 32 gigabyte array when processing an empty list. The vulnerability resides in the ExtUtils-Typemaps-Default distribution and has been documented by the CPAN Security Group.

Why it matters: Developers using Perl modules that depend on affected versions of ExtUtils::Typemaps::STL::List versions before 1.07 face potential memory exhaustion and denial of service when handling empty list inputs; upgrade to version 1.07 or later.

CVEsCVE-2026-107794
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary