CVE-2025-15646

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugs.debian.org/1104789
https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch
https://metacpan.org/release/BPS/HTML-Gumbo-0.19/changes
http://www.openwall.com/lists/oss-security/2026/07/01/7

Configurations

No configuration.

History

30 Sep 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de HTML::Gumbo anteriores a la 0.19 para Perl revelan memoria del heap a través de confusión de tipos. El soporte para el elemento <template> se añadió a libgumbo 0.10.0 en 2015, pero la función walk_tree en lib/HTML/Gumbo.xs no se actualizó para soportarlo. El elemento fue tratado como un nodo de texto, donde strlen() lee más allá del bloque del heap al que apunta el puntero. Cualquier llamador que ejecute parse() con el formato predeterminado => 'string', o con formato => 'tree', en una entrada que contenga un elemento <template> serializa los bytes leídos en exceso en el resultado devuelto, revelando contenidos acotados del heap. formato => 'callback' alcanza un croak en el tipo de nodo no manejado y no se ve afectado.

Information

Published : 2026-07-01 16:16

Updated : 2026-10-06 22:10

NVD link : CVE-2025-15646

Mitre link : CVE-2025-15646

CVE.ORG link : CVE-2025-15646

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

{"id": "CVE-2025-15646", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15646", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T18:08:40.682429Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/bestpractical/HTML-Gumbo", "vendor": "BPS", "product": "HTML::Gumbo", "versions": [{"status": "affected", "version": "0", "lessThan": "0.19", "versionType": "custom"}], "packageName": "HTML-Gumbo", "programFiles": ["lib/HTML/Gumbo.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "walk_tree"}]}]}], "published": "2026-07-01T16:16:29.657", "references": [{"url": "https://bugs.debian.org/1104789", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/BPS/HTML-Gumbo-0.19/changes", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/01/7", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-843"}]}], "descriptions": [{"lang": "en", "value": "HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.\n\nSupport for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.\n\nAny caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected."}, {"lang": "es", "value": "Las versiones de HTML::Gumbo anteriores a la 0.19 para Perl revelan memoria del heap a trav\u00e9s de confusi\u00f3n de tipos.\n\nEl soporte para el elemento <template> se a\u00f1adi\u00f3 a libgumbo 0.10.0 en 2015, pero la funci\u00f3n walk_tree en lib/HTML/Gumbo.xs no se actualiz\u00f3 para soportarlo. El elemento fue tratado como un nodo de texto, donde strlen() lee m\u00e1s all\u00e1 del bloque del heap al que apunta el puntero.\n\nCualquier llamador que ejecute parse() con el formato predeterminado => 'string', o con formato => 'tree', en una entrada que contenga un elemento <template> serializa los bytes le\u00eddos en exceso en el resultado devuelto, revelando contenidos acotados del heap. formato => 'callback' alcanza un croak en el tipo de nodo no manejado y no se ve afectado."}], "lastModified": "2026-10-06T22:10:00.247", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}