CVE catalog

CVE-2026-107794

libextutils-typemaps-default-perl: CVE-2026-107794

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.36% · Oct 25, 2026

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibextutils-typemaps-default-perlsid1.07-1fixed
Debianlibextutils-typemaps-default-perlforky1.07-1fixed
Debianlibextutils-typemaps-default-perltrixie1.05-5vulnerable
Debianlibextutils-typemaps-default-perlbookworm1.05-5vulnerable
Ubuntulibextutils-typemaps-default-perl16.041.05-2vulnerable
Ubuntulibextutils-typemaps-default-perl18.041.05-2vulnerable
Ubuntulibextutils-typemaps-default-perl20.041.05-2vulnerable
Ubuntulibextutils-typemaps-default-perl22.041.05-2.1vulnerable
Ubuntulibextutils-typemaps-default-perl24.041.05-5vulnerable
Ubuntulibextutils-typemaps-default-perl26.101.05-5vulnerable
Ubuntulibextutils-typemaps-default-perl26.041.05-5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibextutils-typemaps-default-perlsourcesid1.07-1not yet assignedNot reported[1150541]
Debianlibextutils-typemaps-default-perlsourceforky1.07-1not yet assignedNot reported[1150541]
Debianlibextutils-typemaps-default-perlsourcetrixie(unfixed)not yet assignedNot reported[1150541]
Debianlibextutils-typemaps-default-perlsourcebookworm(unfixed)not yet assignedNot reported[1150541]

[Debian bug #1150541]

Notes

[trixie] libextutils-typemaps-default-perl: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libextutils-typemaps-default-perl]Affected
    Details (2)

    • 1.05-5 · all · bookworm

      Affected

      dsa · libextutils-typemaps-default-perl · debian · bookworm; dsa · libextutils-typemaps-default-perl · debian · 12

    • 1.05-5 · all · bookworm

      Affected

      dsa · libextutils-typemaps-default-perl · debian · bookworm; dsa · libextutils-typemaps-default-perl · debian · 12

[Debian 13 (Trixie)]

  • [libextutils-typemaps-default-perl]Affected
    Details (2)

    • 1.05-5 · all · trixie

      Affected

      dsa · libextutils-typemaps-default-perl · debian · 13

    • 1.05-5 · all · trixie

      Affected

      dsa · libextutils-typemaps-default-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]