Hi,

The following vulnerabilities were published for libnet-oauth-perl.

CVE-2026-72887[0]:
| Net::OAuth::Client versions before 0.32 for Perl allow the service
| provider to silently downgrade OAuth 1.0a to OAuth 1.0 in
| get_request_token.  Passing a callback to the constructor selects
| OAuth 1.0a. get_request_token then revokes that choice when the
| request token response omits oauth_callback_confirmed, with no
| exception, no warning and no option to require 1.0a. The access
| token request is built from the OAuth 1.0 message class, which has
| no verifier parameter, so oauth_verifier is dropped from the request
| even when get_access_token was passed one.  oauth_verifier is the
| binding that OAuth 1.0a added between the authorization step and the
| token exchange. An application that asked for 1.0a and gets 1.0 is
| open to OAuth 1.0 session fixation, where an attacker obtains a
| request token, has the victim authorize it, and then completes the
| exchange themselves, linking the victim's provider account to a
| session the attacker controls. No attacker action sets up the
| downgrade: a provider that does not confirm the callback is enough.


CVE-2026-72888[1]:
| Net::OAuth versions before 0.32 for Perl allow memory exhaustion via
| unbounded caching of failed module loads in smart_require.
| smart_require stores results in a process-global hash with no bound
| and no eviction, and keeps an entry for every class name it is asked
| about, including names that failed to load, because the return value
| of the failed eval is stored before the error is checked. The key
| comes off the wire on the server side: _signature_method_class
| builds the class name from the signature_method parameter of the
| incoming message, and verify resolves it before any signature is
| checked.  A remote client chooses both how many entries are created
| and how long each key is. In a persistent server the hash grows for
| the life of the worker process until it exhausts memory. Header size
| limits bound the key length on the Authorization header path, but
| not on a POST body.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-72887
https://www.cve.org/CVERecord?id=CVE-2026-72887
[1] https://security-tracker.debian.org/tracker/CVE-2026-72888
https://www.cve.org/CVERecord?id=CVE-2026-72888

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
libnet-oauth-perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144539@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
gregor herrmann <gregoa@debian.org> (supplier of updated libnet-oauth-perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 16 Aug 2026 17:54:05 +0200
Source: libnet-oauth-perl
Architecture: source
Version: 0.32-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
Changed-By: gregor herrmann <gregoa@debian.org>
Closes: 1144539
Changes:
 libnet-oauth-perl (0.32-1) unstable; urgency=medium
 .
   * Import upstream version 0.32.
     - Net::OAuth::Client no longer allows silent downgrades from
       OAuth 1.0a to 1.0 when the remote provider drops the
       oauth_verifier.  The behavior can be re-enabled with the
       allow_v1a_downgrade option. CVE-2026-72887
     - The Net::OAuth smart_require function no longer memoizes
       failures, which allowed attackers to exhaust memory with
       requests for invalid signature methods. CVE-2026-72888
     (Closes: #1144539)
   * Update upstream email addresses.
   * The upstream examples are gone.
   * Install new CONTRIBUTING.md file.
   * Drop 0001-Pin-PKCS-1-v1.5-padding-and-SHA-1-for-RSA-SHA1-signa.patch
     which was taken from upstream Git.
   * Update dependencies.
Checksums-Sha1:
 ed259c19131920ffde84542d82b1cfe40666d50c 2646 libnet-oauth-perl_0.32-1.dsc
 4c8cfa90d058f0ce99ac4bdc20882eb319bea9eb 32274 libnet-oauth-perl_0.32.orig.tar.gz
 7d8c5154f7a30505fe555bf9721e54a31da3fea5 4428 libnet-oauth-perl_0.32-1.debian.tar.xz
 0ecc7a5044b660b2051408cd5a9876a2c3ef1650 106176 libnet-oauth-perl_0.32-1.git.tar.xz
 070168cba2128976ad29beed8a2a60084dd2d9a7 17588 libnet-oauth-perl_0.32-1_source.buildinfo
Checksums-Sha256:
 3d45f2a2ffcc3f8c02c0ab25178a390a7653897e8ec8c78478c8d6e78b673fd1 2646 libnet-oauth-perl_0.32-1.dsc
 163180cf34b03bba31372d5f4cae24d382c41ab828abf34cafad7d9b5727a74a 32274 libnet-oauth-perl_0.32.orig.tar.gz
 b39719e9e76a0e6fc87adfd889b8315847c0f7d8ee3ca8182aeb6fe07c5009f8 4428 libnet-oauth-perl_0.32-1.debian.tar.xz
 4c77f2ba87162bfd79ce1d6d675ee3945c8762c513e22460084660cd62c2011a 106176 libnet-oauth-perl_0.32-1.git.tar.xz
 76d3712cef45e488913cca564344e5a0265f3348623cc92da1be42eeb9803c1d 17588 libnet-oauth-perl_0.32-1_source.buildinfo
Files:
 2ecd9eb3a191c71c5e4a319b30abd05b 2646 perl optional libnet-oauth-perl_0.32-1.dsc
 be08a8e9a6ac5c86d0c9cd521980d07d 32274 perl optional libnet-oauth-perl_0.32.orig.tar.gz
 1b9c1a8af5a643a4d5b7e26ec21b6094 4428 perl optional libnet-oauth-perl_0.32-1.debian.tar.xz
 13547fe2bed1eafe2cbec1481ff2c032 106176 perl None libnet-oauth-perl_0.32-1.git.tar.xz
 c7f553c36af8118fc95ba934a8258c76 17588 perl optional libnet-oauth-perl_0.32-1_source.buildinfo
Git-Tag-Info: tag=e7955ba346336f104f53741bf939df2a18539fd6 fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <gregoa@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqB3jgACgkQYG0ITkaD
wHkcDQ//b6Lz6WWz7dAbih9cUodYRoymttt8GiS+0K6mPepJM8tsHTRhsX+DdC57
QOFTFg2HlgR/xraIhSSJiZr3tqQmojJ3CO78xU2mcFztATtTeQZaWKFCzhvKpg9k
zxnoNXOlTp8o//gYodubtXAZ+FQhR5LstPF+ZVkSJlE1y3ViswEzeid6ZfTlXRzH
VD8kqp9659E7Uxc1kJr73qys9cHYF86Ix38H75MzFRaowz273+L7dYMyitVVnTCm
EEIQ/5Pxwf9jqUCYWbyuy0V6fSc0abUh49Qp4AO4+hNTnReMCd+QnI406233lTVD
nh5IRDmnu41zcgt3dLvRPxrPlwC65R4zOj9iSmwPfI9QKYXb3YQR7WnWCXVXMQ1X
QEpRCQQPhY+U0lo6zRv+r2BueArmbD4dAywhbaPlSkdwpNERYRg6BwrJIaTZ/Ogd
mOjzeRKghHwVCZG4yO5JEQ/EhA4iv8BXpPxZTn2Xm7uwCsjAHaJI2OeFiszSt7Bi
eRvKwdTXddmYQDRlnealzzaJ+3B2rgDNAuI1isDUcCRLSBk6TUzVFB2glySW2Uzz
ZaIHaIYEOk+TsgKoy5HH8tMxyfZf143pGa2idoHkXQH7Ec4gkBBP9XDiIW0n9OQA
jZci/KUenJ0wPcyQkCwS7t7K3hbVJTVlD8fo/PEfwsNpmFiihLM=
=MTBO
-----END PGP SIGNATURE-----