What is the CVSS score of CVE-2025-6498?

CVE-2025-6498 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2025-6498?

Yes, a public proof-of-concept exploit is available for CVE-2025-6498. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-6498?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

tidy-html5 CVE-2025-6498

EUVD-2025-18861 LOW

Memory Leak (CWE-401)

2025-06-23 cna@vuldb.com

Information Disclosure Tidy Htacg

1.9

CVSS 4.0 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Local access
Delivery

Execute tidy-html5 with crafted input
Exploit

Trigger memory leak in defaultAlloc
Execution

Exhaust memory
Impact

Denial of service

Vulnerability Assessment

Weakness	CWE CWE-401 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V14 - Configuration Dependency management, component inventory
Exploitation Conditions	Local access with low privileges (PR:L) is required. The attacker must be able to execute tidy-html5 on the local host with a crafted input. No user interaction needed (UI:N). The vulnerability is triggered via the defaultAlloc function in src/alloc.c.
Impact	CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N gives a base score of 1.9 (Low). EPSS score is 0.04% (13th percentile), indicating very low exploitation probability. No KEV listing. Public exploit exists but requires local access and low privileges. Overall risk is low; not a priority for most environments.
Exploit ScenarioDerived	A local attacker with low privileges runs a crafted HTML file through tidy-html5, triggering the memory leak in defaultAlloc. Repeated execution exhausts system memory, causing denial of service. Public exploit code is available.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 26, 2026

Memory leak in HTACG tidy-html5 5.8.0 via the defaultAlloc function in src/alloc.c allows local attackers to cause denial of service by exhausting memory. A public exploit exists, but no active exploitation has been reported. EPSS score is low (0.04%), indicating low exploitation likelihood.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 22:10 CVSS 3.3

RemediationAI

Upgrade to a patched version of tidy-html5. The vendor has released a fix; refer to the GitHub issue at https://github.com/htacg/tidy-html5/issues/1152 for details. No workarounds are available; upgrading is the recommended action.

Affected VersionsENISA

tidy-html5 5.8.0

Affected Packages

euvd tidy_html5 no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The vulnerability is a CWE-401 memory leak in the defaultAlloc function of tidy-html5, an HTML parsing library. The affected product is identified by CPE cpe:2.3:a:htacg:tidy:5.8.0:*:*:*:*:*:*:*. Memory leaks occur when allocated memory is not freed, leading to resource exhaustion over time.

Know when Tidy gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 3.3 LOW

Local attack vector, low privileges, no user interaction, low availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Ubuntu MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.3 (LOW) 1.9 (LOW)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Sep 30, 2025 - 18:21 vuln.today

Public exploit code

CVE Published

Jun 23, 2025 - 02:15 nvd

LOW 3.3

CVE Published

Jun 23, 2025 - 02:15 cve.org

LOW 1.9

DescriptionCVE.org

A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Executive ViewAI

Why It Matters

CVE-2025-6498 is a low-severity vulnerability in A vulnerability classified as problematic (CVSS 3.3). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low

Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score

0.0%

Top 87% exploitable

Prevalence

Medium

Used in Linux distributions (Ubuntu, Debian)

Exploit

POC

Public exploit code exists

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC Yes

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

Poc

System Exposure· derived

Small

Automatable· derived

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Tidy

View all

CVE-2015-5522 MEDIUM This Month POC

6.8 Aug 11

Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause

CVE-2015-5523 MEDIUM This Month POC

4.3 Aug 11

The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) vi

CVE-2017-17497 HIGH This Week

7.5 Dec 10

In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentatio

CVE-2017-13692 HIGH This Week

7.5 Aug 25

In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault

Same weakness CWE-401 – Memory Leak

View all

CVE-2020-13934 HIGH

7.5

CVE-2016-4232 HIGH POC

7.5

CVE-2024-25450 HIGH POC

8.8

CVE-2023-33718 HIGH POC

8.8

CVE-2019-6128 HIGH POC

8.8

CVE-2026-67183 HIGH POC

8.7

CVE-2023-34451 HIGH POC

8.2

CVE-2020-6079 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

Ubuntu

Priority: Medium

tidy-html5

Release	Status	Version
upstream	needs-triage	-
bionic	deferred	2026-03-11
focal	deferred	2026-03-11
jammy	deferred	2026-03-11
noble	deferred	2026-03-11
oracular	ignored	end of life, was deferred [2026-03-11]
questing	deferred	2026-03-11
plucky	ignored	end of life, was deferred [2026-03-11]

Debian

Bug #1108233

tidy-html5

Release	Status	Fixed Version	Urgency
bookworm, bullseye	vulnerable	2:5.6.0-11	-
trixie	vulnerable	2:5.8.0-2	-
forky, sid	vulnerable	2:5.8.0-2.1	-
(unstable)	fixed	(unfixed)	-

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-6498 REF https://vuldb.com/?ctiid.313614 REF https://vuldb.com/?id.313614 REF https://vuldb.com/?submit.601009

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back