CVE-2026-16634 FELIPE CVE debrief

Who should care

Users of TOML::XS versions before 0.06 for Perl should be concerned about this vulnerability. This includes developers who use TOML::XS in their applications, as well as operators who use systems that rely on TOML::XS. Vulnerability management and security teams should also be aware of this vulnerability and take steps to mitigate it. Additionally, platform administrators who manage systems that use TOML::XS should review the affected scope and take steps to update or mitigate the vulnerability.

Technical summary

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library, which is maintained and does not have this vulnerability. Users should update to TOML::XS version 0.06 or later to prevent potential attacks.

Defensive priority

High

Recommended defensive actions

• Update TOML::XS to version 0.06 or later
• Use the successor tomlc17 library
• Validate and sanitize TOML input to prevent stack overflow
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The tomlc99 library is no longer maintained and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. This vulnerability can cause a stack overflow if an attacker provides a deeply-nested TOML document to the from_toml function. Users should verify the input to this function to prevent potential attacks. The CVE record was published on 2026-07-24T10:16:31.693Z and has not been modified since then. The vulnerability was reported in the issue tracker of the tomlc99 library, which is used by TOML::XS versions before 0.06.

Official resources