CVE-2026-16634 - TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99

CRITICAL

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99

Published Jul 24, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.82%

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99.

The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker.

Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.

TOML::XS version 0.06 or later uses the successor tomlc17 library.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
0	affected	<0.06

Vendor solution

Upgrade to TOML::XS version 0.06 or later.

0.82% 0.00824

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 4, 2026.

EPSS probability 0.00824

Jul-Oct 2026

Table of values (2 key points)

Flat stretches are collapsed. Showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 4, 2026	0.82% (0.00824)	55.91th	v5 (v2026.06.15)
Jul 24, 2026	0.23% (0.00228)	13.64th	v5 (v2026.06.15)

Weaknesses (2)

CWE-1104

CWE-1395

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/07/24/4
https://github.com/cktan/tomlc17
https://github.com/cktan/tomlc99/issues/97		exploitissue-tracking
https://metacpan.org/release/FELIPE/TOML-XS-0.06/changes		release-notes
https://raw.githubusercontent.com/cktan/tomlc99/29076dfd095bbbbd50a3c1b2760d29f4b83e74ac/README.md
https://toml.io/en/v1.0.0		technical-description