CVE-2026-16634

Published: Jul 24, 2026Modified: Jul 27, 2026Deferred

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library.

Related CWEs

Use of Unmaintained Third Party Components

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

References (7)

https://github.com/cktan/tomlc17

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://github.com/cktan/tomlc99/issues/97

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://metacpan.org/release/FELIPE/TOML-XS-0.06/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://raw.githubusercontent.com/cktan/tomlc99/29076dfd095bbbbd50a3c1b2760d29f4b83e74ac/README.md

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

https://toml.io/en/v1.0.0

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

http://www.openwall.com/lists/oss-security/2026/07/24/4

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/cktan/tomlc99/issues/97

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.