Skip to main content

Xml CVE-2026-8177

| EUVDEUVD-2026-29000 HIGH
Out-of-bounds Read (CWE-125)
2026-05-10 CPANSec GHSA-g5h8-x64v-qf5h
Buffer Overflow Denial Of Service Information Disclosure Xml
7.5
CVSS 3.1 · Vendor: CPANSec
View

Vulnerability Assessment

Weakness
CWE
CWE-125
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 11, 2026

Out-of-bounds heap read in XML::LibXML for Perl (all versions through 2.0210) allows remote attackers to trigger denial-of-service crashes by supplying XML node names with truncated UTF-8 sequences. The parser fails to validate multi-byte UTF-8 boundaries in node names, reading past allocated memory into adjacent heap regions. No public exploit identified at time of analysis, with EPSS score of 0.01% indicating very low observed exploitation probability. Vendor-released patch available via upstream commit 15652bd9.

Affected VersionsENISA

XML::LibXML 0 ≤2.0210

Affected Packages

euvd xml_libxml no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Xml gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (CPANSec) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE HIGH
Red Hat 7.5 HIGH

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 11, 2026 - 18:22 NVD
7.5 (None) 7.5 (HIGH)
CVE Published
May 10, 2026 - 20:48 nvd
HIGH 7.5
CVE Published
May 10, 2026 - 20:48 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences.

A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory.

Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

Executive ViewAI

Why It Matters

XML::LibXML for Perl versions through 2.0210 contain an out-of-bounds heap read vulnerability that allows remote attackers to cause denial-of-service crashes by submitting malformed XML with improperly encoded UTF-8 node names. Organizations using this library to parse untrusted XML input face application availability risk; a successful attack requires no authentication and can be triggered remotely. Leadership should prioritize patching to prevent service disruptions, particularly in web services, document processing systems, or any XML-parsing infrastructure.

Recommended Action

Within 24 hours: identify all systems and applications using XML::LibXML for Perl through version 2.0210 via inventory and dependency scanning. Within 7 days: apply vendor-released patch via upstream commit 15652bd9 (upgrade to version 2.0211 or later); test in staging environment before production deployment. Within 30 days: verify patch deployment across all affected systems and confirm no legacy versions remain in use; document remediation completion.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, restrict XML parsing to trusted sources only and implement input validation to reject XML with malformed UTF-8 sequences before processing by XML::LibXML; monitor for unexpected application crashes or parsing failures as indicators of exploitation attempts.

Threat Intelligence Overview

EPSS Score
0.0%
Top 99% exploitable
Social Media
2
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Xml

View all
CVE-2026-93990 HIGH POC
8.7 Sep 19

Malformed UTF-16 decoding in libexpat through 2.8.4 lets remote attackers hide XML markup from the parser: a lone high s
CVE-2025-40934 CRITICAL
9.3 Nov 26

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. Rated critical se
CVE-2026-9390 CRITICAL
9.1 Aug 03

Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document no
CVE-2026-57074 CRITICAL
9.1 Jul 16

Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing
CVE-2026-9487 CRITICAL
9.1 Aug 03

Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate

CVE-2026-18568 HIGH
7.5 Aug 03

Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to s
CVE-2026-13401 HIGH
7.5 Jul 16

Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Affected
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

References

Advisories & patches
PATCH https://github.com/cpan-authors/XML-LibXML/commit/15652bd905a6c9dda59a81b14d4766adbbae2ea8.patch ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-8177 ADVISORY https://vuldb.com/vuln/362578 REF http://www.openwall.com/lists/oss-security/2026/05/10/8 REF http://www.openwall.com/lists/oss-security/2026/05/11/2 REF https://access.redhat.com/errata/RHSA-2026:39547 REF https://access.redhat.com/errata/RHSA-2026:39553 REF https://access.redhat.com/errata/RHSA-2026:39878 REF https://access.redhat.com/errata/RHSA-2026:68632 REF https://access.redhat.com/errata/RHSA-2026:68685 REF https://access.redhat.com/errata/RHSA-2026:68688 REF https://access.redhat.com/errata/RHSA-2026:68693 REF https://access.redhat.com/security/cve/CVE-2026-8177 REF https://bugzilla.redhat.com/show_bug.cgi?id=2468684 REF https://github.com/cpan-authors/XML-LibXML/issues/146 REF https://github.com/cpan-authors/XML-LibXML/pull/149 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8177.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy