VulnSocial

CVE-2026-16634Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-1104

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-29); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-29: 1Mentions · 2026-08-01: 1Patch / Workaround · 2026-07-29: 1Technical Details · 2026-07-29: 1Technical Details · 2026-08-01: 107-2908-01
Signal classification2 categories
Patch
150.0%
Disclosure
150.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-291
Patch1
2026-08-011
Disclosure1
Full discourse2 posts
  • SecAlerts@SecAlertsCo
    Patch

    🔁 Uncontrolled recursion in TOML::XS for Perl — CVE-2026-16634 (CVSS 9.8). Bundled tomlc99 library is unmaintained and vulnerable. Upgrade to TOML::XS 0.06 now. #cybersecurity #ciso #cto #vulnerabilities #perl https://secalerts.co/vulnerability/CVE-2026-16634?utm_campaign=x https://t.co/akbDY66xVy

    Post summary

    The tweet announces a high‑severity vulnerability in TOML::XS (CVE‑2026‑16634) and urges users to upgrade to version 0.06 to patch the issue, with no mention of active exploitation or demonstrable proof of concept.

    00010119
    872 followersView on X
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN CVE-2026-13089: OIDC::Lite through 0.12.1 allow ID Token signature verification bypass via a token-controlled algorithm allowlist https://www.openwall.com/lists/oss-security/2026/07/22/17 CVE-2026-16634: TOML::XS before 0.06 bundle an unsupported and vulnerable version of tomlc99 https://www.openwall.com/lists/oss-security/2026/07/24/4

    Post summary

    The passage announces two Perl module CVEs, offering concise technical descriptions but no proof‑of‑concept, exploit code, patch information, or evidence of active exploitation.

    00000181
    4.7K followersView on X

Explore more

Back to dashboard