AI analysis
ExtUtils::Typemaps::STL::List before 1.07 has an integer underflow (CWE-191) in its OUTPUT typemaps for Perl. On an empty list those typemaps call av_extend with len-1, which underflows so Perl tries to allocate an array of 2^32 slots, about 32 GiB, and can exhaust process memory. The described impact is denial of service through memory exhaustion, not code execution or data theft, in programs that use bindings generated from the vulnerable typemap. Perl XS code built with ExtUtils::Typemaps::STL::List versions before 1.07 is affected; a similar issue was already fixed in ExtUtils::Typemaps::STL::Vector 1.05. There is no known public proof of concept, no report of exploitation in the wild, the flaw is not in CISA KEV, and CVSS has not yet been scored.
What to do: Upgrade ExtUtils::Typemaps::STL::List to version 1.07 or later and regenerate any Perl XS typemaps or bindings produced with an older release. Until that is done, do not pass empty lists through the affected OUTPUT typemaps in long-running or exposed processes, and watch for sudden multi-gigabyte memory growth.
Affected
| CPAN ExtUtils::Typemaps::STL::List | before 1.07 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.