CVE-2013-10076 Details
Description
ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.
A memory exhaustion vulnerability exists in ExtUtils::Typemaps::STL::Vector for Perl, affecting versions prior to 1.05. The issue arises when an empty list is processed, leading to an invalid memory allocation. The OUTPUT typemaps incorrectly call av_extend with a length of -1, which undeflows and causes av_extend to allocate a 32 GiB array. This flaw can be exploited by mapping an empty STL container to an array, triggering an out-of-memory error.
Users can upgrade to ExtUtils::Typemaps::Default version 1.05 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934.patch | CPANSec | Source CodeVendor |
| https://metacpan.org/release/SMUELLER/ExtUtils-Typemaps-Default-1.05/changes | CPANSec | Release NotesVendor |
| https://rt.cpan.org/Public/Bug/Display.html?id=91213 | CPANSec | Issue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-191 | Integer Underflow (Wrap or Wraparound) | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| ExtUtils::Typemaps::STL::Vector | < 1.05 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | CPANSec |