CVE-2026-72888

Name of the Vulnerable Software and Affected Versions Net::OAuth versions prior to 0.32

Description An issue exists where memory exhaustion can occur due to unbounded caching of failed module loads within the smart require() function. The function stores results in a process-global hash without bounds or eviction, retaining entries for every class name requested, including those that failed to load. This happens because the return value of the failed eval is stored before the error is verified. On the server side, the signature method class function constructs the class name using the signature method parameter from an incoming message, which is then resolved by the verify() function before any signature is checked. A remote client can control the number of entries created and the length of each key. In persistent servers, this hash grows throughout the life of the worker process until memory is exhausted. While header size limits restrict key length via the Authorization header, they do not apply to POST bodies.

Recommendations Update to version 0.32 or later.