{"id":"CVE-2026-107794","revision":"5fdabb66c00c47c49aabc2f5d1723204","records":[{"revision":"5fdabb66c00c47c49aabc2f5d1723204","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107794","aliases":[],"title":"ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list","description":"ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.\n\nThe OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.\n\nNote that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.","state":0,"publishedAt":"2026-10-10T12:45:19.991+00:00","modifiedAt":"2026-10-16T19:25:02.591+00:00","affected":[{"ecosystem":"https://cpan.org/modules","name":"ExtUtils-Typemaps-Default","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"collectionURL\": \"https://cpan.org/modules\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"modules\": [\n                        \"ExtUtils::Typemaps::STL::List\"\n                    ],\n                    \"packageName\": \"ExtUtils-Typemaps-Default\",\n                    \"packageURL\": \"pkg:cpan/ExtUtils-Typemaps-Default\",\n                    \"programFiles\": [\n                        \"lib/ExtUtils/Typemaps/STL/List.pm\"\n                    ],\n                    \"repo\": \"https://github.com/tsee/extutils-typemap-default\",\n                    \"versions\": [\n                        {\n                            \"lessThan\": \"1.07\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.07/changes","https://rt.cpan.org/Public/Bug/Display.html?id=91213","https://www.cve.org/CVERecord?id=CVE-2013-10076"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107794","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107794","identifiers":["CVE-2026-107794"]},"retained":false,"historicalAffected":[]}],"coverage":[]}