========================================================================
CVE-2026-16634                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-16634
   Distribution:  TOML-XS
       Versions:  before 0.06

       MetaCPAN:  https://metacpan.org/dist/TOML-XS
       VCS Repo:  https://github.com/FGasper/p5-TOML-XS

TOML::XS versions before 0.06 for Perl bundle an unsupported and
vulnerable version of tomlc99

Description
-----------
TOML::XS versions before 0.06 for Perl bundle an unsupported and
vulnerable version of tomlc99.

The tomlc99 library is no longer maintained, and has an uncontrolled
recursion vulnerability publicly reported in the issue tracker.

Any caller that passes untrusted TOML to from_toml risks a stack
overflow from a deeply-nested document.

TOML::XS version 0.06 or later uses the successor tomlc17 library.

Problem types
-------------
- CWE-1104 Use of Unmaintained Third Party Components
- CWE-1395 Dependency on Vulnerable Third-Party Component

Workarounds
-----------
Only parse trusted TOML files.

Solutions
---------
Upgrade to TOML::XS version 0.06 or later.

References
----------
https://metacpan.org/release/FELIPE/TOML-XS-0.06/changes
https://raw.githubusercontent.com/cktan/tomlc99/29076dfd095bbbbd50a3c1b2760d29f4b83e74ac/README.md
https://github.com/cktan/tomlc99/issues/97
https://github.com/cktan/tomlc17
https://toml.io/en/v1.0.0

Timeline
--------
- 2021-08-12: Version 0.05 released.
- 2025-05-02: The README for tomlc99 was updated to say that it was
   obsolete.
- 2026-03-07: Vulnerability posted to tomlc99 issue tracker.
- 2026-07-24: Version 0.06 released.