The vulnerability in TOML::XS before version 0.06 arises from the inclusion of the unmaintained tomlc99 library, which contains an uncontrolled recursion flaw. This flaw can be triggered by passing untrusted, deeply nested TOML data to the from_toml function, potentially causing a stack overflow. The issue is addressed in TOML::XS version 0.06 and later by switching to the successor tomlc17 library, which does not have this vulnerability.

Applications using TOML::XS versions before 0.06 that parse untrusted TOML data with from_toml are at risk of stack overflow due to uncontrolled recursion in the bundled tomlc99 library. This can lead to denial of service or application crashes. No known exploits are reported in the wild at this time.

Upgrade to TOML::XS version 0.06 or later, which replaces the vulnerable tomlc99 library with the maintained tomlc17 library. Patch status is not explicitly confirmed by the vendor advisory, but the version change indicates remediation. Until upgraded, avoid processing untrusted deeply nested TOML data with affected versions.