Which versions of HTACG are affected by CVE-2025-6496?

CVE-2025-6496 is a low-severity vulnerability in A vulnerability (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…. A patch is available.

How to fix or mitigate CVE-2025-6496?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

HTACG CVE-2025-6496

Q: What is the CVSS score of CVE-2025-6496?

CVE-2025-6496 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2025-18857 LOW

Improper Resource Shutdown or Release (CWE-404)

2025-06-23 cna@vuldb.com

Denial Of Service

1.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.3 (LOW) 1.9 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18857

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

CVE Published

Jun 23, 2025 - 00:15 nvd

LOW 3.3

DescriptionCVE.org

A vulnerability was found in HTACG tidy-html5 5.8.0. It has been declared as problematic. This vulnerability affects the function InsertNodeAsParent of the file src/parser.c. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Analysis

Same weakness CWE-404 – Improper Resource Shutdown or Release

View all

CVE-2024-0546 HIGH POC

7.5

CVE-2018-8120 HIGH POC

7.0

CVE-2024-31611 CRITICAL POC

9.1

CVE-2025-1103 HIGH POC

7.1

CVE-2022-4066 HIGH POC

8.2

CVE-2025-5867 HIGH POC

8.0

CVE-2018-8410 HIGH POC

7.8

CVE-2026-38641 HIGH POC

7.5

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

tidy-html5

Release	Status	Version
upstream	needs-triage	-
bionic	deferred	2026-03-11
focal	deferred	2026-03-11
jammy	deferred	2026-03-11
noble	deferred	2026-03-11
oracular	ignored	end of life, was deferred [2026-03-11]
plucky	ignored	end of life, was deferred [2026-03-11]
questing	deferred	2026-03-11

Debian

Bug #1108235

tidy-html5

Release	Status	Fixed Version	Urgency
bookworm, bullseye	vulnerable	2:5.6.0-11	-
trixie	vulnerable	2:5.8.0-2	-
forky, sid	vulnerable	2:5.8.0-2.1	-
(unstable)	fixed	(unfixed)	-

CVE-2025-6496 vulnerability details – vuln.today

Back

HTACG CVE-2025-6496

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Same weakness CWE-404 – Improper Resource Shutdown or Release

Same technique Denial Of Service

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code