CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list
Perl ExtUtils::Typemaps::STL::List before 1.07 allocates a 32 GiB array for an empty list.
Robert Rothenberg reported CVE-2026-107794 on oss-security for the Perl module ExtUtils::Typemaps::STL::List, distributed with ExtUtils-Typemaps-Default. Versions before 1.07 allocate a 32 GiB array when handling an empty list, which can exhaust memory. The post does not describe exploitation in the wild.
30