EUVD-2025-18861Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector, low privileges, no user interaction, low availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
AnalysisAI
Memory leak in HTACG tidy-html5 5.8.0 via the defaultAlloc function in src/alloc.c allows local attackers to cause denial of service by exhausting memory. A public exploit exists, but no active exploitation has been reported. EPSS score is low (0.04%), indicating low exploitation likelihood.
Technical ContextAI
The vulnerability is a CWE-401 memory leak in the defaultAlloc function of tidy-html5, an HTML parsing library. The affected product is identified by CPE cpe:2.3:a:htacg:tidy:5.8.0:*:*:*:*:*:*:*. Memory leaks occur when allocated memory is not freed, leading to resource exhaustion over time.
RemediationAI
Upgrade to a patched version of tidy-html5. The vendor has released a fix; refer to the GitHub issue at https://github.com/htacg/tidy-html5/issues/1152 for details. No workarounds are available; upgrading is the recommended action.
Heap-based buffer overflow in the ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause
The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of service (crash) vi
In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentatio
In Tidy 5.5.31, the IsURLCodePoint function in attrs.c allows attackers to cause a denial of service (Segmentation Fault
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| upstream | needs-triage | - |
| bionic | deferred | 2026-03-11 |
| focal | deferred | 2026-03-11 |
| jammy | deferred | 2026-03-11 |
| noble | deferred | 2026-03-11 |
| oracular | ignored | end of life, was deferred [2026-03-11] |
| questing | deferred | 2026-03-11 |
| plucky | ignored | end of life, was deferred [2026-03-11] |
Debian
Bug #1108233| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bookworm, bullseye | vulnerable | 2:5.6.0-11 | - |
| trixie | vulnerable | 2:5.8.0-2 | - |
| forky, sid | vulnerable | 2:5.8.0-2.1 | - |
| (unstable) | fixed | (unfixed) | - |
Share
External POC / Exploit Code
Leaving vuln.today