Skip to main content

tidy-html5 CVE-2025-6496

| EUVDEUVD-2025-18857 LOW
Improper Resource Shutdown or Release (CWE-404)
2025-06-23 cna@vuldb.com
Denial Of Service
1.9
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local attack vector, low privileges, only availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ubuntu
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 29, 2026 - 01:11 NVD
3.3 (LOW) 1.9 (LOW)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 22:10 euvd
EUVD-2025-18857
Analysis Generated
Mar 15, 2026 - 22:10 vuln.today
CVE Published
Jun 23, 2025 - 00:15 nvd
LOW 3.3

DescriptionCVE.org

A vulnerability was found in HTACG tidy-html5 5.8.0. It has been declared as problematic. This vulnerability affects the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

AnalysisAI

Null pointer dereference in HTACG tidy-html5 5.8.0 allows local attackers to cause a denial of service via the InsertNodeAsParent function in src/parser.c. A public exploit exists, but no active exploitation has been reported. EPSS score is low (0.02%), indicating minimal exploitation risk.

Technical ContextAI

The vulnerability is a null pointer dereference (CWE-404) in the HTML parser library tidy-html5, specifically in the InsertNodeAsParent function within src/parser.c. The library is used for cleaning and formatting HTML content. The CPE data indicates only version 5.8.0 is affected. The root cause is improper handling of a null pointer when inserting a node as a parent, leading to a crash.

RemediationAI

Apply the vendor-released patch available from the tidy-html5 repository. Upgrade to a patched version beyond 5.8.0. As a workaround, restrict local access to the tidy-html5 binary to trusted users only. Note that this is a local vulnerability, so limiting user permissions can mitigate risk.

Same weakness CWE-404 – Improper Resource Shutdown or Release

View all
CVE-2018-8120 HIGH POC
7.0
CVE-2025-15687 LOW POC
2.1
CVE-2025-15686 LOW POC
2.1
CVE-2024-0546 HIGH POC
7.5
CVE-2024-31611 CRITICAL POC
9.1
CVE-2025-1103 HIGH POC
7.1
CVE-2022-4066 HIGH POC
8.2
CVE-2025-5867 HIGH POC
8.0

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
tidy-html5
Release Status Version
upstream needs-triage -
bionic deferred 2026-03-11
focal deferred 2026-03-11
jammy deferred 2026-03-11
noble deferred 2026-03-11
oracular ignored end of life, was deferred [2026-03-11]
plucky ignored end of life, was deferred [2026-03-11]
questing deferred 2026-03-11

Debian

Bug #1108235
tidy-html5
Release Status Fixed Version Urgency
bookworm, bullseye vulnerable 2:5.6.0-11 -
trixie vulnerable 2:5.8.0-2 -
forky, sid vulnerable 2:5.8.0-2.1 -
(unstable) fixed (unfixed) -

Share

CVE-2025-6496 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy