CVE-2013-10076: ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-10 · updated 2026-10-16
Weakness: CWE-191

Description

ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.

Affected products

ExtUtils-Typemaps-Default: before 1.05 — fixed in 1.05

How to fix

Upgrade to a fixed version: ExtUtils-Typemaps-Default 1.05. Check the vendor advisory for mitigations.

References

https://github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934.patch
https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.05/changes
https://rt.cpan.org/Public/Bug/Display.html?id=91213

Get alerted when CVE-2013-10076 or the next vulnerability affects your stack