Heap memory disclosure via type confusion in HTML::Gumbo for Perl (CVE-2025-15646)

HTML::Gumbo before version 0.19 fails to handle the `<template>` HTML element in its `walk_tree` function, treating it as a text node and causing `strlen()` to over-read a heap buffer. Callers using `parse()` with `format => 'string'` or `format => 'tree'` on input containing a `<template>` element will have bounded heap contents serialized into the returned result, disclosing heap memory to the caller. Affected versions: - before 0.19 We recommend updating to: 0.19. CVSS 9.8 · our assessment: act_now Reference: https://seclists.org/oss-sec/2026/q3/6 Details: https://vuln.today/cve/CVE-2025-15646