The vulnerability is caused by the use of the unmaintained tomlc99 library in TOML::XS versions earlier than 0.06. tomlc99 contains an uncontrolled recursion flaw that can result in a stack overflow when parsing deeply nested TOML documents. This flaw leads to an application crash, which manifests as a denial of service. The weakness aligns with CWE‑1104 (Uncontrolled Recursion) and CWE‑1395 (Overflow Due to Recursion).

The affected product is the Perl module TOML::XS from vendor FELIPE. Any installation of this module with a version earlier than 0.06 is vulnerable. Versions 0.06 and greater replace tomlc99 with tomlc17, which does not exhibit the recursion issue.

The EPSS score of less than 1 % indicates a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. The CVSS score of 9.8 indicates a critical severity. The flaw is activated when an application passes an untrusted, deeply nested TOML file to the from_toml routine, which is inferred from the description that the recursion problem occurs when parsing untrusted TOML. Attackers would need to supply such a file to a vulnerable application to trigger the stack overflow and provoke a denial of service. No additional prerequisites beyond the ability to provide a crafted TOML document are stated, and no mention of elevated privileges or network accessibility is provided. Consequently, the risk is limited to the scope of the vulnerable process and depends on the system’s use of this parser.