CVE-2026-72888 RRWO CVE debrief

Who should care

Developers and administrators using Net::OAuth in Perl applications should be aware of this vulnerability and take steps to mitigate it. This includes assessing usage, verifying versions, and potentially upgrading to a fixed version of Net::OAuth. Additionally, security teams and vulnerability management teams should prioritize this vulnerability given its potential impact on memory exhaustion and the ease with which it can be triggered by a remote client.

Technical summary

The smart_require function in Net::OAuth versions before 0.32 for Perl stores results in a process-global hash with no bounds and no eviction. This leads to potential memory exhaustion as the hash grows with every class name it is asked about, including names that failed to load. A remote client can choose both how many entries are created and how long each key is, potentially leading to memory exhaustion in a persistent server. The issue is exacerbated in persistent servers where the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.

Defensive priority

Medium priority given the CVSS score of 6.5 and potential for memory exhaustion via unbounded caching.

Recommended defensive actions

• Inventory and assess Net::OAuth usage in Perl applications.
• Verify if applications are using a version of Net::OAuth earlier than 0.32.
• Consider upgrading to Net::OAuth version 0.32 or later.
• Implement monitoring for potential memory exhaustion issues in affected applications.
• Review and adjust caching mechanisms in affected applications to prevent unbounded growth.
• Perform a thorough review of the codebase for any custom implementations that may be affected by this vulnerability.
• Ensure that all team members are aware of the potential risks and are prepared to take necessary actions.

Evidence notes

Evidence from the CVE Program and NVD suggests a memory exhaustion vulnerability in Net::OAuth versions before 0.32 for Perl. The smart_require function stores results in a process-global hash with no bounds and no eviction, leading to potential memory exhaustion. This issue can be triggered by a remote client choosing both how many entries are created and how long each key is, potentially leading to memory exhaustion in a persistent server. To verify and mitigate this vulnerability, defenders should assess Net::OAuth usage in Perl applications, verify if applications are using a version of Net::OAuth earlier than 0.32, and consider upgrading to Net::OAuth version 0.32 or later. Additionally, implementing monitoring for potential memory exhaustion issues in affected applications and reviewing and adjusting caching mechanisms in affected applications to prevent unbounded growth are recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.