Net::OAuth versions prior to 0.32 for Perl have a resource exhaustion vulnerability (CWE-770) in the smart_require function. The function caches results of module load attempts in a process-global hash with no bounds or eviction policy, including failed loads. Because the key is derived from the signature_method parameter of incoming messages, a remote client can control both the number and length of keys stored. In persistent server environments, this unbounded growth can exhaust memory, leading to denial of service. Header size limits mitigate this on the Authorization header path but not on POST body inputs.

An attacker with network access and limited privileges can cause a denial of service by exhausting memory on the server hosting vulnerable Net::OAuth versions. This does not impact confidentiality or integrity but results in availability degradation due to resource exhaustion. The CVSS score of 6.5 reflects a medium severity with no confidentiality or integrity impact but high impact on availability.

No official patch or remediation is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the size and number of requests that can trigger signature_method processing or isolate vulnerable components to reduce impact.