CVE-2026-16634 in TOML::XS
Summary
by MITRE • 07/24/2026
TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99.
The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker.
Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.
TOML::XS version 0.06 or later uses the successor tomlc17 library.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability resides within the TOML::XS Perl module ecosystem where versions prior to 006 incorporate an outdated and unmaintained dependency known as tomlc99. This library represents a significant security risk due to its abandonment status and documented weaknesses in the software supply chain. The tomlc99 library lacks active maintenance and security updates, making it susceptible to various exploitation vectors that could compromise systems relying on it for configuration parsing operations.
The technical flaw manifests as an uncontrolled recursion vulnerability within the tomlc99 library implementation. This weakness occurs when processing deeply nested TOML documents containing excessive levels of nesting or circular references that cause the parser to recursively call itself without proper termination conditions. The recursive function calls consume stack memory rapidly, leading to stack overflow conditions that can result in application crashes or potentially exploitable system instability.
The operational impact of this vulnerability extends beyond simple service disruption to include potential denial of service scenarios and system compromise. Any Perl application utilizing TOML::XS version 0.05 or earlier that processes untrusted TOML input becomes vulnerable to stack overflow attacks through carefully crafted malicious documents. Attackers can exploit this weakness by submitting malformed configuration files or data streams that trigger the recursive parsing behavior, potentially causing applications to crash or behave unpredictably.
This vulnerability aligns with CWE-674 (Uncontrolled Recursion) and represents a classic example of how legacy dependencies in software supply chains can introduce persistent security weaknesses. The issue also maps to ATT&CK technique T1203 (Exploitation for Client Execution) where attackers leverage parsing vulnerabilities to execute malicious code through configuration file processing. Organizations deploying systems that depend on TOML::XS should consider this vulnerability as part of their broader application security posture assessment.
The remediation strategy involves upgrading to TOML::XS version 0.06 or later, which transitions from the vulnerable tomlc99 library to the actively maintained tomlc17 successor. This migration addresses the core issue by implementing proper recursion limits and improved parsing algorithms that prevent stack overflow conditions. System administrators should also implement input validation measures for any TOML processing operations and consider additional security controls such as resource monitoring and application sandboxing to mitigate potential exploitation attempts.
Organizations relying on legacy Perl applications containing vulnerable TOML::XS versions must prioritize this upgrade path while maintaining awareness of potential compatibility issues with existing configuration files. The transition to tomlc17 ensures continued support for modern TOML parsing requirements while eliminating the security risks associated with abandoned software dependencies. Regular dependency audits and automated vulnerability scanning should be implemented to prevent similar issues from arising in other software components throughout the organization's technology stack.