EUVD-2025-210396
GHSA-754r-h5mg-r795
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated attacker-controlled HTML triggers the over-read (AV:N/AC:L/PR:N/UI:N), but the effect is a bounded read-only heap disclosure, so C:H with no integrity or availability impact.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
4DescriptionCVE.org
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.
Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.
Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.
AnalysisAI
Heap memory disclosure in the Perl HTML::Gumbo module before 0.19 lets remote attackers leak bounded chunks of process heap by submitting HTML containing a <template> element. The XS binding's walk_tree function misclassifies the template node as a text node and runs strlen() past the intended buffer, serializing the over-read bytes into parse() output. No public exploit is identified at time of analysis, and EPSS is low (0.66%), but exploitation is automatable and the flaw is trivially triggerable against any service that parses untrusted HTML with the default settings.
Technical ContextAI
HTML::Gumbo is a Perl XS wrapper around Google's libgumbo HTML5 parsing library. libgumbo 0.10.0 (2015) introduced a dedicated GUMBO_NODE_TEMPLATE node type for the HTML <template> element, but the wrapper's walk_tree function in lib/HTML/Gumbo.xs only recognized GUMBO_NODE_DOCUMENT and GUMBO_NODE_ELEMENT, so template nodes fell through to the text-node handling path. That path calls strlen() on a pointer that does not address a NUL-terminated text buffer, causing a heap over-read. This is the classic CWE-843 (Type Confusion / Access of Resource Using Incompatible Type) pattern: an object of one type is interpreted with the semantics of another, and the resulting length mis-computation leaks adjacent heap contents. The single affected component is cpe:2.3:a:bps:html::gumbo, the Best Practical Solutions (BPS) Perl distribution.
RemediationAI
Vendor-released patch: 0.19 - upgrade HTML::Gumbo to 0.19 or later (e.g. cpan HTML::Gumbo / cpanm HTML::Gumbo@0.19), which adds GUMBO_NODE_TEMPLATE handling to walk_tree per commit 15c0598909d4a64f47ef0a1abc5051f4e113c186 (https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch); Debian users should track https://bugs.debian.org/1104789 for the distribution package. If immediate upgrade is impossible, a targeted workaround is to switch callers to format => 'callback', which croaks on the unhandled template node type and is not affected - with the trade-off that callers must implement their own node-walking logic and lose the convenience of the 'string'/'tree' serializers. Alternatively, pre-strip or reject <template> elements from untrusted input before parsing, accepting that this changes parser semantics and may drop legitimate markup. Advisory details are in the oss-security post at https://seclists.org/oss-sec/2026/q3/6 and http://www.openwall.com/lists/oss-security/2026/07/01/7.
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can
Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated
Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows r
Denial of service in HTML::Bare through version 0.04, a Perl XML/HTML parsing module, allows remote unauthenticated atta
Heap information disclosure in HTML::Entities for Perl (versions before 3.84) allows remote attackers to leak adjacent h
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and applic
Html contains a vulnerability that allows attackers to denial of service (DoS) if an attacker provides specially crafted
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today