Loading story…
A heap memory disclosure flaw tracked as CVE-2025-15646 was disclosed in HTML::Gumbo for Perl, affecting versions before 0.19. The bug is caused by type confusion in the walk_tree function after libgumbo added support for the HTML <template> element, leading the code to mis-handle that element as a text node and causing strlen() to over-read heap memory.
When applications call parse() with the default format => 'string' setting, or with format => 'tree', and process input containing a <template> element, bounded heap contents can be serialized into the returned result and exposed. The issue was fixed in HTML-Gumbo 0.19 by adding GUMBO_NODE_TEMPLATE to the container node types handled by walk_tree.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
HTML::Gumbo version 0.19 fixed an information disclosure vulnerability affecting earlier versions, where type confusion in walk_tree could cause strlen() to over-read heap memory when parsing input containing a <template> element. The fix added GUMBO_NODE_TEMPLATE to the container node types handled by walk_tree.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceseclists.org
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw tracked as **CVE-2025-15646** was fixed in **HTML-Gumbo** / Debian's `libhtml-gumbo-perl` after incorrect handling of the HTML `<template>` element caused erratic behavior and use of uninitialized memory during string output generation. The bug affected the `GUMBO_NODE_TEMPLATE` node type, which had been introduced in Gumbo `0.10.0` but was not properly supported by the Perl bindings, leading the parser to treat template nodes as text nodes and produce random output alongside Valgrind warnings in `Gumbo.xs`. A patch updated `walk_tree()` so `GUMBO_NODE_TEMPLATE` is processed like document and element container nodes instead of following the text-node code path. The fix attaches a `GumboElement` value rather than a `GumboText`, addressing the memory-handling issue reported in Debian Bug **#1104789** and GitHub issue **#6**. Debian shipped the remediation in `libhtml-gumbo-perl` version **0.18-5**, while noting that full `<template>` support remains a separate enhancement topic.
Jul 2, 2026
A heap overflow vulnerability tracked as **CVE-2026-14739** was disclosed in **DBI for Perl** versions before `1.650`. The flaw occurs during SQL statement preparsing when an attacker supplies an extreme number of placeholders, leading to an out-of-bounds write classified as **CWE-787**. The issue stems from an incomplete fix for **CVE-2026-10879**, which still failed to allocate enough memory when handling roughly **1.2 million placeholders**. The maintainers addressed the bug in **DBI `1.650`** by enforcing a hard limit of **99,999 placeholders**, preventing the oversized input condition that triggered the heap overflow. Organizations using Perl applications that rely on DBI should identify deployments running versions earlier than `1.650` and prioritize upgrades to remove exposure to malformed SQL statements that could crash processes or potentially enable further exploitation.
Aug 15, 2026
The CPAN Security Group disclosed two memory-safety vulnerabilities affecting widely used Perl modules. **CVE-2026-7040** impacts `Text::Minify::XS` from `v0.3.0` before `v0.7.8`, where malformed UTF-8 input can trigger a heap overflow in the `minify` and `minify_utf8` functions, leading to heap corruption through improper Unicode handling. Maintainers advised users to upgrade to `v0.7.8` or later, and said deployments that cannot patch immediately should validate strings before passing them to the affected routines. A separate advisory, **CVE-2026-7111**, affects `Text::CSV_XS` before `1.62` and stems from a use-after-free when registered callbacks extend the Perl argument stack. The bug arises because methods including `Parse`, `print`, `getline`, and `getline_all` may retain a stale stack pointer across callback execution, creating a path to type confusion, memory corruption, crashes, or logic errors. The issue does not affect `Text::CSV_XS` instances that do not use registered callbacks, and the fix was released in version `1.62` after a public patch and CPAN publication.
Jun 29, 2026