CVE-2026-16634

The record

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library.

Affected packages

Related vulnerabilities

• CVE-2026-11325 Description Cloudflare was recently notified by external researchers of vulnerabilities… CWE-1104
• CVE-2026-60368 Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion… CWE-1104
• CVE-2026-56580 HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). CWE-1104
• CVE-2026-3031 Image::EPEG versions through 0.15 for Perl embeds an unsupported version of the Epeg… CWE-1104
• CVE-2024-23581 The HCL Traveler for Microsoft Outlook libraries are being flagged as potentially… CWE-1104
• CVE-2026-21821 The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the… CWE-1104
• CVE-2026-41468 Beghelli Sicuro24 SicuroWeb embeds AngularJS 1.5.2, an end-of-life component containing… CWE-1104
• CVE-2025-55277 HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability… CWE-1104