The Perl module TOML::XS is vulnerable to a critical stack overflow attack due to its reliance on an unmaintained and insecure third-party library.

The software incorporates the unmaintained tomlc99 library, which suffers from an uncontrolled recursion flaw. An unauthenticated attacker can trigger a stack overflow by submitting a specially crafted, deeply nested TOML document to the from_toml function.

Successful exploitation of this vulnerability allows an attacker to cause a crash or potentially execute arbitrary code, leading to a complete denial of service or full system compromise. Given the CVSS score of 9.8, this vulnerability poses a severe risk to any application that processes untrusted TOML input, as it requires no authentication or user interaction to trigger.

Immediate Action: Upgrade the TOML::XS module to version 0.06 or later, which replaces the vulnerable tomlc99 library with the updated tomlc17 library.

Proactive Monitoring: Monitor application logs for segmentation faults or sudden service restarts that may indicate attempted exploitation of the parser.

Compensating Controls: Implement input validation to strictly limit the depth and complexity of TOML documents processed by the application, effectively reducing the attack surface until the patch is applied.

Public Exploit Available: No

This vulnerability represents a critical security risk due to the potential for remote code execution and the ease of exploitation. Security teams should prioritize the update of the TOML::XS module across all production environments immediately to ensure the transition to the secure tomlc17 library is completed and the stack overflow risk is neutralized.