CVE-2026-16634

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99.

The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker.

Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.

TOML::XS version 0.06 or later uses the successor tomlc17 library.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1104

Affected software

No affected versions have been published.

Timeline

Published
Jul 24, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-166358.8The Pronamic Pay plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 10.1.0 This is due to the CVE-2026-166367.2The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerablCVE-2026-166376.5OPeNDAP Hyrax allows SSRF and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak EarthdataCVE-2026-166386.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSSCVE-2026-166399.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication BCVE-2026-16646.9Summary An Insecure Direct Object Reference has been found to exist in `createHeaderBasedEmailResolver()` function within the Cloudflare AgCVE-2026-166406.1Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows CVE-2026-166419.8Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.CVE-2026-166425.7Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.CVE-2026-166435.7Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.CVE-2026-166449.1Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 CVE-2026-166459.1Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue af
CVE-2026-16634: Critical severity, CVSS 9.8 | Vulnix