Executive brief
TOML::XS, a Perl module used for parsing TOML configuration files, used an outdated and unmaintained underlying library. This flaw allows an attacker to crash an application by providing a specially crafted, deeply nested configuration file. Such an exploit results in a denial-of-service, potentially disrupting business operations or service availability.
Technical details
TOML::XS versions prior to 0.06 bundle the tomlc99 C library, which contains an uncontrolled recursion vulnerability in its parsing logic. Specifically, the functions parse_keyval and parse_array do not limit recursion depth when processing dotted keys or nested arrays. An attacker can provide a crafted TOML document to the from_toml function to trigger a stack overflow, leading to a segmentation fault and denial-of-service. The issue is resolved in TOML::XS version 0.06 by migrating to the maintained tomlc17 library.
Affected products
- FELIPE TOML::XS before 0.06
Timeline
- 2026-07-24: disclosed
- 2026-07-24: patched: Fixed in version 0.06
- 2026-07-24: advisory