The vulnerability is found in Net::OAuth versions prior to 0.32 for Perl. The smart_require routine stores the result of module load operations in a global hash without imposing any size limit or eviction policy, even when the load fails. Because the cache key is derived from the signature_method parameter supplied by an OAuth client, an attacker can trigger repeated failed loads of arbitrary class names. Each failed attempt reserves space in the hash, eventually exhausting the process memory and causing a denial of service.

Perl applications that rely on Net::OAuth 0.30 or earlier to process OAuth requests, such as web services, APIs, or any server component that interprets the signature_method field from client messages. The issue is triggered when the server creates a class name from client data and attempts to load it; any application using the vulnerable library is at risk.

The flaw can be triggered remotely by any client able to send OAuth messages. By controlling the signature_method value and optionally the size of fields in the Authorization header or POST body, the attacker can determine the number and length of cache entries. The EPSS score is < 1% and the CVSS score is 6.5; despite the moderate severity, the unbounded memory growth presents a high likelihood of causing service interruption for long‑running workers. The vulnerability is not yet listed in the CISA KEV catalog, but the lack of bounds makes it a significant denial‑of‑service risk.