# CVE-2026-107794: ExtUtils::Typemaps::STL::List memory exhaustion via av_extend integer underflow

Source: https://junglewise.ai/threats/cve-2026-107794-extutils-typemaps-stl-list-versions-before-1-07-for-perl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-107794 · Severity: info · Published 2026-10-10

ExtUtils::Typemaps::STL::List is a Perl library used to convert data types between Perl and C. A flaw in its OUTPUT typemaps causes it to allocate a 32 GiB array when processing an empty list, exhausting system memory and potentially causing application outages.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan).

## Quick answers

**Is CVE-2026-107794 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107794 being exploited in the wild.

**How severe is CVE-2026-107794?** Informational severity, published 10 October 2026.

**Which products and versions are affected?** CPAN ExtUtils::Typemaps::STL::List before 1.07.

**Is there a fix for CVE-2026-107794?** Yes: fixed in ExtUtils::Typemaps::STL::List 1.07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-107794 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-107794?** Check whether you run CPAN ExtUtils::Typemaps::STL::List at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in ExtUtils::Typemaps::STL::List 1.07

## Technical details

The OUTPUT typemaps incorrectly call av_extend(av, len-1), which on an empty list (len=0) causes integer underflow; av_extend then attempts to allocate 2^32 array slots, triggering memory exhaustion. This affects type conversions from C structures to Perl, triggered when XS code passes an empty list through the typemap.

## Affected products

- CPAN ExtUtils::Typemaps::STL::List before 1.07

## Timeline

- 2026-10-10: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.07/changes](https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.07/changes)