CVE-2026-107794: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-107794 is a Denial of Service vulnerability caused by an integer underflow in ExtUtils::Typemaps::STL::List for Perl, affecting all versions before 1.07. When the OUTPUT typemaps call av_extend(av, len-1) on an empty list, the len-1 operation underflows (since len is 0), causing av_extend to allocate an array with 2^32 slots (~32 GiB), leading to memory exhaustion. The vulnerability was published on October 10, 2026, and a patch is available in version 1.07. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an integer underflow (CWE-191) in the OUTPUT typemap handler of ExtUtils::Typemaps::STL::List. When processing an empty C++ STL list, the code computes len-1 where len equals zero; because the variable is treated as an unsigned integer, this wraps around to the maximum unsigned 32-bit value (4,294,967,295), which is then passed to Perl's internal av_extend() function. av_extend() dutifully attempts to allocate an array with 2^32 slots, consuming approximately 32 GiB of memory. A similar underflow was previously identified and fixed in the related ExtUtils::Typemaps::STL::Vector module at version 1.05, indicating a class of bugs in the STL typemap family (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes memory exhaustion on the host system, consuming approximately 32 GiB of RAM, which will crash the affected Perl application or destabilize the underlying system. The impact is limited to availability — there is no confidentiality or integrity impact. Any user or remote client capable of triggering Perl code that invokes the affected OUTPUT typemap with an empty list can cause the denial of service, making this exploitable in network-facing applications that use the module (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is rated automatable (no user interaction required) with network attack vector and low complexity, meaning exploitation is straightforward once a vulnerable code path is reachable. The EPSS score is approximately 0.185% (8th percentile), indicating a low near-term exploitation probability. The CVE status is listed as "Deferred" and it is not currently listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Identify target: Locate a network-accessible Perl application that uses ExtUtils::Typemaps::STL::List versions before 1.07 and exposes functionality that processes C++ STL list objects via XS/typemap bindings.
2. Craft empty list input: Prepare a request or input that results in an empty C++ STL list being passed to the affected OUTPUT typemap handler — for example, submitting an empty collection or triggering a code path that returns an empty list.
3. Trigger the underflow: Submit the crafted input to the target application. The OUTPUT typemap calls av_extend(av, len-1) with len=0, causing an integer underflow to 2^32-1.
4. Memory exhaustion: av_extend() attempts to allocate ~32 GiB of memory, causing the Perl process or the host system to exhaust available RAM and crash, resulting in a denial of service (Github Advisory).

• Logs: Application logs showing sudden crashes or out-of-memory (OOM) errors in Perl processes; kernel OOM killer logs (dmesg or /var/log/kern.log) terminating Perl worker processes.
• System Metrics: Sudden spike in memory consumption to near-system-maximum levels by a Perl process, followed by process termination; monitoring alerts for memory utilization exceeding 90–100%.
• Process: Perl processes (perl, plackup, or application-specific workers) appearing briefly with very high RSS (Resident Set Size) before being killed by the OS OOM killer.

The primary remediation is to upgrade ExtUtils::Typemaps::STL::List (part of the ExtUtils-Typemaps-Default distribution) to version 1.07 or later, which fixes the integer underflow (Github Advisory). If immediate patching is not feasible, restrict access to any application endpoints that invoke the affected typemap code to trusted users only, reducing the attack surface. Additionally, monitor systems for unexpected memory consumption spikes as an interim detection measure (Red Hat Bugzilla).

Red Hat's Product Security team tracked this issue via Bugzilla (Bug 2548974) with a high severity rating, and it was assigned to the Product Security DevOps Team for triage. The vulnerability was noted in the oss-security mailing list. No significant broader media coverage or notable researcher commentary beyond standard vulnerability database entries has been observed.