EUVD-2026-40180
GHSA-89gv-4m9m-97p2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Memory leak impacts availability (A:L) and may expose heap data (C:L); no integrity impact is supported by description, so I:N overrides provided I:L.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
3DescriptionCVE.org
CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away.
The minify function has a memory leak when processing a document containing only characters to be removed, such as comments and whitespace.
AnalysisAI
Memory leak in CSS::Minifier::XS (Perl CPAN module by gtermars) before version 0.14 allows unauthenticated remote attackers to trigger unreleased memory by submitting CSS documents composed entirely of removable content - comments and whitespace. When the minify() function processes such input and the entire document is consumed by the minification pass, the underlying XS (C extension) layer fails to release the allocated memory, satisfying CWE-401. The Information Disclosure tag and C:L CVSS rating suggest leaked heap contents may expose sensitive in-process data, though the more immediate risk is incremental memory exhaustion in long-running web services. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) reflects minimal observed exploitation interest.
Technical ContextAI
CSS::Minifier::XS is a Perl XS module (cpe:2.3:a:gtermars:css::minifier::xs:*) that wraps a C implementation for high-performance CSS whitespace and comment stripping. XS modules allocate memory in C and must manually manage it; the root cause (CWE-401, Missing Release of Memory after Effective Lifetime) is a code path in the minify() function that is reached only when every byte of the input document is elided - i.e., the document consists solely of CSS comments (/* ... */) and/or whitespace. In this edge case the function's cleanup logic appears to be skipped, leaving the input buffer allocated. Because this is an XS extension, the leak occurs in the C heap and is not subject to Perl's garbage collector. The module is typically embedded in Perl web frameworks or asset-pipeline tooling that accept user-supplied or externally-sourced CSS, which is the avenue for network exposure.
RemediationAI
Upgrade to CSS::Minifier::XS 0.14 or later via CPAN ('cpan CSS::Minifier::XS' or 'cpanm CSS::Minifier::XS') - this is the vendor-released patch per the changelog at https://metacpan.org/release/GTERMARS/CSS-Minifier-XS-0.14/changes and confirmed by the oss-security advisory at https://seclists.org/oss-sec/2026/q2/1067. For SUSE-packaged deployments, apply the distribution's updated perl-CSS-Minifier-XS package once available through the standard update channel. If immediate upgrade is not possible and the service accepts user-supplied CSS, apply input validation at the application layer to reject CSS documents that contain only whitespace and comment tokens before passing them to minify() - this eliminates the triggering condition with no functional impact on legitimate CSS. Alternatively, wrap calls to minify() so that empty or whitespace-only inputs are returned as-is without invoking the XS function. For persistent long-running processes, periodic worker restart (e.g., SIGHUP-based recycling in mod_perl or Starman) can bound the impact of the leak until patching is completed.
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today