https://bugzilla.redhat.com/show_bug.cgi?id=2536984
Bug ID: 2536984
Summary: CVE-2026-72888 perl-Net-OAuth: Net::OAuth: Denial of
Service via unbounded caching in smart_require
[epel-8]
Product: Fedora EPEL
Version: epel8
Status: NEW
Whiteboard: {"flaws": ["664dd79c-4806-4112-9a31-1311aaf67908"]}
Component: perl-Net-OAuth
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected], [email protected],
[email protected],
[email protected], [email protected]
Blocks: 2517236 (CVE-2026-72888)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded
caching of failed module loads in smart_require.
smart_require stores results in a process-global hash with no bound and no
eviction, and keeps an entry for every class name it is asked about, including
names that failed to load, because the return value of the failed eval is
stored before the error is checked. The key comes off the wire on the server
side: _signature_method_class builds the class name from the signature_method
parameter of the incoming message, and verify resolves it before any signature
is checked.
A remote client chooses both how many entries are created and how long each key
is. In a persistent server the hash grows for the life of the worker process
until it exhausts memory. Header size limits bound the key length on the
Authorization header path, but not on a POST body.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2517236
[Bug 2517236] CVE-2026-72888 perl-Net-OAuth: Net::OAuth: Denial of Service via
unbounded caching in smart_require
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2536984
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202536984%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
