ExtUtils-Typemaps-Default (Product): news timeline & CVEs

CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

Perl ExtUtils::Typemaps::STL::List before 1.07 allocates a 32 GiB array for an empty list.

Robert Rothenberg reported CVE-2026-107794 on oss-security for the Perl module ExtUtils::Typemaps::STL::List, distributed with ExtUtils-Typemaps-Default. Versions before 1.07 allocate a 32 GiB array when handling an empty list, which can exhaust memory. The post does not describe exploitation in the wild.

oss-securityOct 10, 13:47 UTC · 6d agoVulnerability 2 sources CVE-2026-1077944· 1 read

CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

Perl ExtUtils::Typemaps::STL::String before 1.06 may read an SV length before stringifying arguments.

Robert Rothenberg reported CVE-2026-107373 on oss-security for Perl's ExtUtils::Typemaps::STL::String, part of ExtUtils-Typemaps-Default. Versions before 1.06 may read a Perl SV's length in the T_STD_STRING typemap before the argument is stringified, which can cause incorrect memory access. The post does not describe exploitation in the wild.

oss-securityOct 10, 13:45 UTC · 6d agoVulnerability 2 sources CVE-2026-1073731

ExtUtils-Typemaps-Default

Timeline2 articles

Related CVEsby mentions

Appears with

CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

CVE-2026-107373: ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument