CVE-2026-107373: T_STD_STRING typemap may read SV size before converting the argument

Advisory CVE-2026-107373 describes an issue in the T_STD_STRING typemap of ExtUtils::Typemaps::STL::String for Perl. According to the text, versions before 1.06 may read the size of an SV before converting the argument to a string. The affected distribution is listed as ExtUtils-Typemaps-Default, with versions before 1.06. The text cites the distribution page on MetaCPAN and a code repository. The information was posted by Robert Rothenberg on October 10, 2026, in the oss-sec feed, and the content is an automatic translation of the CPAN Security Group advisory. To verify, consult the original message in the oss-sec list for 2026 (fourth quarter, message 130), the distribution page on MetaCPAN and the module's version history. The link to Rota Nacional is indirect: the platform does not patch third-party Perl libraries and this text does not describe a Rota feature. Teams that use AI tools to generate Perl code should still review the dependencies that code relies on.