CVE-2013-10076: 
Linux Debian vulnerability analysis and mitigation

CVE-2013-10076 is a Denial of Service vulnerability in the ExtUtils::Typemaps::STL::Vector module (part of the ExtUtils-Typemaps-Default Perl distribution) affecting all versions before 1.05. When processing an empty list, the OUTPUT typemaps call av_extend(av, len-1) where len is zero, causing an integer underflow that instructs Perl's internal array extension function to allocate approximately 2^32 slots (~32 GiB), leading to memory exhaustion. The vulnerability was originally introduced in 2013 and formally disclosed in October 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an integer underflow (CWE-191) in lib/ExtUtils/Typemaps/STL/Vector.pm. The OUTPUT typemap code unconditionally calls av_extend(av, len-1) to pre-allocate a Perl array (AV) before populating it from a C++ std::vector. When the vector is empty (len == 0), the expression len-1 underflows the unsigned integer to 0xFFFFFFFF (4,294,967,295), causing av_extend to attempt allocation of 2^32 array slots (~32 GiB). This flaw is present in multiple typemap variants (T_STD_VECTOR_*, T_STD_VECTOR_STD_STRING, T_STD_VECTOR_CSTRING, and their pointer variants). The fix, committed on December 6, 2013 by Steffen Mueller, adds a simple if (len) guard before each av_extend call (Patch Commit, GitHub Advisory).

Successful exploitation causes memory exhaustion on the host running the affected Perl application, effectively crashing the process or the entire system depending on available memory and OS-level protections. The impact is limited to availability — there is no confidentiality or integrity impact. Any application that uses ExtUtils::Typemaps::STL::Vector to return empty C++ vectors to Perl callers is potentially vulnerable, and an attacker who can influence the data returned through such typemaps can trigger the condition remotely (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation for this vulnerability (GitHub Advisory). The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.185% (8th percentile), indicating a low probability of exploitation in the near term. The vulnerability is automatable (no user interaction or privileges required) but requires the target application to expose a code path that passes an empty C++ vector through the affected typemaps.

1. Identify target: Locate a network-accessible Perl application that uses ExtUtils::Typemaps::STL::Vector (from ExtUtils-Typemaps-Default < 1.05) and exposes functionality backed by C++ std::vector types via XS/typemap bindings.
2. Trigger empty vector return: Craft an input or request to the application that causes the underlying C++ code to return an empty std::vector to the Perl OUTPUT typemap handler (e.g., a query that yields zero results from a C++ data structure).
3. Underflow triggered: The OUTPUT typemap calls av_extend(av, 0-1), where len is an unsigned integer, causing it to underflow to 0xFFFFFFFF.
4. Memory exhaustion: Perl's av_extend attempts to allocate ~32 GiB of memory, exhausting system RAM and swap, crashing the application or the host (Patch Commit, GitHub Advisory).

• Logs: Application crash logs or Perl runtime errors indicating out-of-memory (OOM) conditions; kernel OOM killer logs (dmesg or /var/log/kern.log) showing the Perl process being killed.
• System: Sudden spike in memory consumption to near-system-capacity levels by a Perl process; system swap exhaustion coinciding with requests that return empty data sets from C++ vector-backed functions.
• Process: Perl interpreter process (perl) consuming abnormally large amounts of virtual memory (approaching or exceeding 32 GiB) before terminating.

Upgrade ExtUtils-Typemaps-Default to version 1.05 or later, which adds a if (len) guard before each av_extend call to prevent the underflow (Patch Commit, CPAN Changes). If immediate patching is not possible, restrict or validate inputs to ensure that code paths using the affected OUTPUT typemaps are never invoked with empty C++ vectors from untrusted sources. System-level memory limits (e.g., ulimit -v or cgroup memory limits) can reduce the blast radius of exploitation but will not prevent the crash.