========================================================================
CVE-2026-107794                                      CPAN Security Group
========================================================================

         CVE ID:  CVE-2026-107794

   Distribution:  ExtUtils-Typemaps-Default
       Versions:  before 1.07
       MetaCPAN: https://metacpan.org/dist/ExtUtils-Typemaps-Default
       VCS Repo:  https://github.com/tsee/extutils-typemap-default

ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a
32 GiB array on an empty list

Description
-----------
ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a
32 GiB array on an empty list.

The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this
undeflows, and av_extend will allocate an array with 2^32 slots,
leading to memory exhaustion.

Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector
version 1.05.

Problem types
-------------
- CWE-191 Integer Underflow (Wrap or Wraparound)

Solutions
---------
Upgrade to ExtUtils::Typemaps::Default version 1.07 or later.

Rebuild any modules that use ExtUtils::Typemaps::Default as part of
their build process.

References
----------
https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.07/changes
https://rt.cpan.org/Public/Bug/Display.html?id=91213
https://www.cve.org/CVERecord?id=CVE-2013-10076

Timeline
--------
- 2013-12-06: Issue with ExtUtils::Typemaps::STL::Vector reported for
   version 1.04.
- 2013-12-06: ExtUtils::Typemaps::Default version 1.05 released with
   fix for CVE-2013-10076.
- 2026-10-08: Issue with ExtUtils::Typemaps::STL::List reported to
   CPANSec. CVE-2013-10076 assigned retroactively.
- 2026-10-09: ExtUtils::Typemaps::Default version 1.07 released with
   fix for CVE-2026-107794.