Bug 2548974 (CVE-2026-107794) - CVE-2026-107794 perl-extutils-typemaps-default: ExtUtils::Typemaps::STL::List: Denial of Service via integer underflow on empty list
Summary: CVE-2026-107794 perl-extutils-typemaps-default: ExtUtils::Typemaps::STL::List...
Keywords:
Status: NEW
Alias: CVE-2026-107794
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2550238
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-10 13:02 UTC by OSIDB Bzimport
Modified: 2026-10-13 07:34 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-10 13:02:03 UTC 
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.

The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.

Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.
Note You need to log in before you can comment on or make changes to this bug.