CVE-2026-72888 Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require.
Remote attackers can exhaust server memory by sending crafted OAuth messages, causing denial of service in applications using Net::OAuth.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72888?
CVE-2026-72888 is a medium-severity denial of service vulnerability, published on 16 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require.
smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked.
A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.
Weakness: CWE-770
Which versions are affected by CVE-2026-72888?
How do I fix CVE-2026-72888?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-72888 being exploited?
There is no known exploitation of CVE-2026-72888 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-72888, GHSA-m2cv-cq5x-47ph, UBUNTU-CVE-2026-72888.