Description

Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked. A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-16T14:16:54.970Z",
  "pubdate": "2026-08-16T14:16:54.970Z",
  "executiveSummary": "Net::OAuth versions before 0.32 for Perl suffer from a memory exhaustion vulnerability caused by unbounded caching of failed module loads within the smart_require function. This flaw allows unauthenticated remote attackers to trigger a denial of service against persistent server processes.\nThe vulnerability impacts server-side applications utilizing Net::OAuth to process incoming messages. By supplying arbitrary and non-existent class names via the signature_method parameter in network requests, attackers can force the application to perpetually store failed evaluation results in a process-global hash without any eviction mechanism or size limitation.\nThe risk implication is severe, as sustained exploitation leads to uncontrolled memory consumption, process crashes, and service unavailability. Attackers require no prior authentication or privileges, and can execute the attack remotely over the network by leveraging either Authorization headers or POST request bodies.\nExploitation requirements are minimal, relying entirely on the ability to send crafted requests containing malicious signature_method parameters to the vulnerable server. While header size limits constrain key lengths via the Authorization header path, POST bodies permit larger payloads, amplifying the memory consumption rate per request.",
  "technicalDetails": "The vulnerability resides in the smart_require function within Net::OAuth versions prior to 0.32 for Perl, which acts as the vulnerable component handling dynamic class loading.\nThe root cause of the memory exhaustion is the unbounded caching mechanism implemented via a process-global hash. When smart_require attempts to load a class, it stores the results of the evaluation in this hash. Crucially, the return value of the failed eval is stored before the error is checked, ensuring that even failed module loads generate a permanent cache entry for every requested class name.\nThe attack flow proceeds as follows: A remote, unauthenticated client sends an incoming message to the server where the _signature_method_class function builds a class name dynamically from the signature_method parameter. The verify function then resolves this class name prior to performing any cryptographic signature verification. The attacker explicitly controls both the total quantity of unique entries created and the string length of each key by supplying arbitrary values over the network.\nIn persistent server architectures, such as FastCGI, mod_perl, or long-running daemon processes, this global hash accumulates entries for the entire lifecycle of the worker process. Each invalid signature_method string submitted by the client appends a new key-value pair to the cache. Because there is no bound or eviction policy, repeated requests eventually exhaust available system memory, leading to fatal out-of-memory errors and process termination.\nAuthentication and privilege requirements are absent, as the vulnerability is triggered during the initial parsing and verification phase of incoming requests before authentication checks occur. Network exposure is broad, affecting any service exposing the vulnerable Net::OAuth endpoint to untrusted clients. The payload behavior involves malformed or randomized signature_method parameters designed to bypass cache reuse and maximize heap allocation. The post-exploitation impact is strictly localized to a denial of service via resource exhaustion of the target worker processes."
}