Memory Exhaustion in Net::OAuth for Perl by Vurtdev

CVE-2026-72888

What is CVE-2026-72888?

The Net::OAuth library for Perl contains a vulnerability that allows for memory exhaustion due to unbounded caching of failed module loads in the smart_require function. When invoked, smart_require can build a process-global hash that continuously grows as it stores class names, including those that failed to load. This behavior leads to excessive memory consumption during the lifecycle of a persistent server process, potentially exhausting available memory. As clients can control the number of entries and their length, this presents a significant risk to the stability of affected services.

References