CVE-2026-107794
Description
A flaw was found in ExtUtils::Typemaps::STL::List. An attacker could exploit this vulnerability by supplying an empty list to an application using the affected typemap. When processing an empty list, an integer underflow occurs during memory allocation calculations, causing the application to attempt to allocate an excessively large array. This behavior leads to memory exhaustion, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated with an Important severity impact because an unauthenticated remote attacker can cause a denial of service through process termination due to unbounded memory allocation without requiring privileges. The flaw is rooted in XS typemapping logic that translates data between Perl and C++ standard containers, triggering an integer underflow when returning zero-length collections. In Red Hat environments, exposure is limited to Perl services deploying compiled XS modules built using these typemaps and handling untrusted user input.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
