Critical· 9.8official fix available
CVE-2026-16634
The TOML::XS Perl library includes an outdated and unmaintained version of the tomlc99 library. This outdated component is vulnerable to uncontrolled recursion when processing certain files.
publishedJul 24, 2026
last modifiedJul 27, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
52th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Aug 26, 2026
An official fix is available, so this entry is kept for 30 days and then removed automatically.
01
Who is affected
Users of the TOML::XS Perl bundle in versions prior to 0.06.
02
Real-world impact
An attacker could provide a specially crafted, deeply-nested TOML file that causes the application to crash due to a stack overflow.
03
Why this severity
This is a critical vulnerability because it can be exploited remotely without any user interaction or authentication, potentially leading to a complete system crash.
04
What to do about it
official fix available
recommended steps
- 01Upgrade TOML::XS to version 0.06 or later.
NVD-referenced vendor advisory
05
Timeline
- Jul 24, 2026 · 8d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoAdvisory updatedThe NVD record was last revised.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
06
How it’s attacked
Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →