What is the CVSS score of CVE-2026-7040?

CVE-2026-7040 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Text::Minify::XS are affected by CVE-2026-7040?

Text::Minify::XS (versions 0.3.0-0.7.7) contains a denial-of-service flaw that crashes applications when processing malformed UTF-8 input, potentially disrupting any business process that relies on…

How to fix or mitigate CVE-2026-7040?

Within 24 hours, identify and inventory all applications and dependencies using Text::Minify::XS v0.3.0 through v0.7.7, and document exposure to untrusted or external text input. Within 7 days, implement input validation to reject or sanitize malformed UTF-8 sequences before passing data to minify() or minify_utf8() functions; deploy rate-limiting on affected endpoints and enable detailed logging to detect exploitation attempts. Within 30 days, monitor CPAN for the release of Text::Minify::XS v0.7.8 or later, plan a phased upgrade across affected systems, and evaluate alternative minification libraries as a contingency if patches are delayed.

Text::Minify::XS CVE-2026-7040

EUVD-2026-25833 HIGH

Improper Handling of Unicode Encoding (CWE-176)

2026-04-27 CPANSec

Buffer Overflow Text Rrwo

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote attacker-supplied malformed UTF-8 reliably triggers heap corruption with no auth or interaction (AV:N/AC:L/PR:N/UI:N), and impact is a crash only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 02:01 vuln.today

CVSS changed

Apr 27, 2026 - 15:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 27, 2026 - 13:00 euvd

EUVD-2026-25833

CVE Published

Apr 27, 2026 - 12:29 nvd

HIGH 7.5

DescriptionCVE.org

Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters.

The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption.

Note that the minify_utf8 function is an alias for minnify.

AnalysisAI

Denial of service in the Perl module Text::Minify::XS (v0.3.0 up to but excluding v0.7.8) arises because its minify functions mishandle certain malformed UTF-8 byte sequences, corrupting the heap. A remote attacker who can supply crafted text to an application that calls minify (or its alias minify_utf8) can trigger heap corruption and crash the process. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.04%), and the flaw is not in CISA KEV.

Technical ContextAI

Text::Minify::XS is an XS (C-backed) Perl module that strips leading and trailing whitespace from text to reduce its size. Because the whitespace-stripping logic is implemented in C for performance, it operates directly on the byte buffer, and the CWE-176 (Improper Handling of Unicode Encoding) root cause is that the parser does not correctly validate multi-byte UTF-8 sequences. When a malformed UTF-8 character is encountered, the length/boundary calculation runs past the intended heap allocation, producing an out-of-bounds write (a heap buffer overflow, consistent with the 'Buffer Overflow' tag). The affected code path is shared: minify_utf8 is documented as an alias for minify, so both entry points are vulnerable. The affected product is identified by CPE cpe:2.3:a:rrwo:text::minify::xs (author RRWO / Rob Rothenberg).

RemediationAI

Vendor-released patch: upgrade Text::Minify::XS to v0.7.8 or later, which corrects the malformed-UTF-8 handling (see the changelog at https://metacpan.org/release/RRWO/Text-Minify-XS-v0.7.8/changes and advisory GHSA-jqhf-vv4h-77h2). Update via CPAN (e.g. cpanm Text::Minify::XS) and rebuild any XS dependency chain. If you cannot patch immediately, the practical compensating control is to validate or sanitize input before it reaches minify/minify_utf8 - decode and re-encode text through a strict UTF-8 validator (such as Encode with the FB_CROAK/strict flag) and reject or replace malformed sequences, which prevents the malformed bytes from reaching the vulnerable C code at the cost of extra processing per request; alternatively, restrict the minify code path to trusted, already-validated input only. Since this is a library rather than a network service, there is no port or feature to disable.