{"cve":"CVE-2026-72888","nvd":{"published":"2026-08-16T14:16:54.970","modified":"2026-08-26T16:51:19.490","status":"Deferred","description":"Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require.\n\nsmart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked.\n\nA remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-770"],"references":["https://github.com/vurtdev/Net-OAuth/commit/ee713fc96263c70b3b9a5280612618b474576f8f.patch","https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-m2cv-cq5x-47ph","https://metacpan.org/release/RRWO/Net-OAuth-0.32/changes","http://www.openwall.com/lists/oss-security/2026/08/16/4"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-72888","score":0.00548,"percentile":0.45916,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}