Loading story…
A flaw tracked as CVE-2025-15646 was fixed in HTML-Gumbo / Debian's libhtml-gumbo-perl after incorrect handling of the HTML <template> element caused erratic behavior and use of uninitialized memory during string output generation. The bug affected the GUMBO_NODE_TEMPLATE node type, which had been introduced in Gumbo 0.10.0 but was not properly supported by the Perl bindings, leading the parser to treat template nodes as text nodes and produce random output alongside Valgrind warnings in Gumbo.xs.
A patch updated walk_tree() so GUMBO_NODE_TEMPLATE is processed like document and element container nodes instead of following the text-node code path. The fix attaches a GumboElement value rather than a GumboText, addressing the memory-handling issue reported in Debian Bug #1104789 and GitHub issue #6. Debian shipped the remediation in libhtml-gumbo-perl version 0.18-5, while noting that full <template> support remains a separate enhancement topic.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Debian Bug #1104789 documented CVE-2025-15646 in libhtml-gumbo-perl, where parsing the HTML <template> element could cause erratic behavior and use of uninitialized memory during string output generation. Debian noted the issue was fixed in libhtml-gumbo-perl version 0.18-5.
A patch was submitted for HTML-Gumbo to correct handling of the GUMBO_NODE_TEMPLATE node type, which had been incorrectly processed as a text node and could access uninitialized memory. The fix changes walk_tree() so template nodes are treated as container nodes and assigned a GumboElement value.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A heap memory disclosure flaw tracked as **CVE-2025-15646** was disclosed in **HTML::Gumbo** for Perl, affecting versions before `0.19`. The bug is caused by type confusion in the `walk_tree` function after libgumbo added support for the HTML `<template>` element, leading the code to mis-handle that element as a text node and causing `strlen()` to over-read heap memory. When applications call `parse()` with the default `format => 'string'` setting, or with `format => 'tree'`, and process input containing a `<template>` element, bounded heap contents can be serialized into the returned result and exposed. The issue was fixed in **HTML-Gumbo 0.19** by adding `GUMBO_NODE_TEMPLATE` to the container node types handled by `walk_tree`.
Jul 12, 2026
Red Hat disclosed and patched two **medium-severity** cross-site scripting flaws in Go's `html/template` package, tracked as `CVE-2026-39823` and `CVE-2026-39826`. The bugs were reported on 2026-05-07 and affect template escaping logic in cases where developers rely on `html/template` to safely handle untrusted data in HTML output. `CVE-2026-39823` stems from improper URL escaping in a `meta` tag's `content` attribute when ASCII whitespace appears around the `=` character, which can let malicious input bypass protections and trigger XSS. `CVE-2026-39826` affects escaping inside `<script>` tags when the `type` attribute is empty or contains ASCII whitespace, causing inserted data to be escaped incorrectly. Red Hat said fixes were released through multiple RHSA advisories for **RHEL 8, 9, and 10**, including **RHEL 10.0 EUS** and **RHEL 9.6 EUS**.
Sep 5, 2026
Two high-severity vulnerabilities were disclosed in widely used file-parsing libraries, allowing crafted media files to trigger memory-safety failures during parsing. In **cgltf** `<= 1.15`, `CVE-2026-32845` stems from an integer overflow in `cgltf_validate()` while checking sparse accessors in malicious glTF or GLB files. The unchecked arithmetic can lead to heap buffer over-reads in `cgltf_calc_index_bound()`, causing crashes and potentially exposing process memory. A separate flaw, `CVE-2026-40494`, affects the **SAIL** image loading and saving library’s TGA RLE decoder in `tga.c`. The bug is a heap-based buffer overflow caused by missing bounds checks on the raw-packet path, while the run-packet path correctly clamps writes; attackers can use a crafted TGA file to write up to 496 bytes of controlled data past the end of a heap buffer. The issue affects versions before commit `45d48d1f2e8e0d73e80bc1fd5310cb57f4547302` and carries a critical `CVSS:3.1` rating due to potential confidentiality, integrity, and availability impact.
Jun 29, 2026