openwall.com
http://www.openwall.com/lists/oss-security/2026/07/24/4 CVE-2026-16634
CRITICAL
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99
Record summary
CVE-2026-16634 has a selected CVSS score of 9.8 (critical).
Description
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 27, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
TOML::XSBrowse FELIPE / TOML::XSDefault status: unaffected | CVE List | Before 0.06 | affected |
References
7github.com
https://github.com/cktan/tomlc17 github.comissue tracking
https://github.com/cktan/tomlc99/issues/97 metacpan.orgrelease notes
https://metacpan.org/release/FELIPE/TOML-XS-0.06/changes nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2026-16634 raw.githubusercontent.com
https://raw.githubusercontent.com/cktan/tomlc99/29076dfd095bbbbd50a3c1b2760d29f4b83e74ac/README.md toml.ioTechnical description
https://toml.io/en/v1.0.0