CVE-2026-107794: ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

ExtUtils::Typemaps::STL::List before 1.07 has an integer underflow (CWE-191) in its OUTPUT typemaps for Perl. On an empty list those typemaps call av_extend with len-1, which underflows so Perl tries to allocate an array of 2^32 slots, about 32 GiB, and can exhaust process memory. The described impact is denial of service through memory exhaustion, not code execution or data theft, in programs that use bindings generated from the vulnerable typemap. Perl XS code built with ExtUtils::Typemaps::STL::List versions before 1.07 is affected; a similar issue was already fixed in ExtUtils::Typemaps::STL::Vector 1.05. There is no known public proof of concept, no report of exploitation in the wild, the flaw is not in CISA KEV, and CVSS has not yet been scored.