CVE-2026-107794: Perl module ExtUtils::Typemaps::STL::List allocates 32 GiB for an empty list
The CPAN Security Group disclosed CVE-2026-107794: versions of the Perl module before 1.07 allocate a 32 GiB array when processing an empty list. The advisory was published on oss-sec on 10 October 2026.
Source: CVE-2026-107794: ExtUtils::Typemaps::STL::List aloca array de 32 GiB para lista vazia (seclists.org). Text prepared with AI from this source.
What happened and what to do
The CPAN Security Group advisory, published on the oss-sec list on 10 October 2026 by Robert Rothenberg, describes CVE-2026-107794 in the ExtUtils-Typemaps-Default distribution, which contains the ExtUtils::Typemaps::STL::List module for Perl. Versions before 1.07 allocate a 32 GiB array when processing an empty list, which can exhaust memory and crash processes using this distribution.
For a company, the risk lies in builds and services that depend on Perl bindings and third-party components, since an empty input can cause denial of service through excessive memory consumption. Practical actions: inventory all Perl dependencies and their versions across servers, container images and CI pipelines; upgrade to version 1.07 or later; apply per-process memory limits (cgroups, ulimit) to build jobs and workers; and add a dependency check to CI that fails when vulnerable versions are present. Monitoring memory peaks per job helps detect similar cases.
How the consultancy can help
Exposure diagnosis: we map where the ExtUtils-Typemaps-Default distribution appears in your environment, including servers, containers and pipelines. We then implement the upgrade, resource limits and automated dependency checks in CI, with ongoing operation.
Next step
Send a short description of your environment and how Perl is used in your systems. With it, we prepare a diagnosis and a scoped proposal for your company.
Let's assess your project
I reply with scope and a proposal.