Skip to main content

HTML::Entities CVE-2026-8829

| EUVDEUVD-2026-34194 HIGH
Use After Free (CWE-416)
2026-06-04 CPANSec GHSA-9p7j-9995-m88w
Information Disclosure Use After Free Memory Corruption Html
7.5
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SUSE
4.8 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

4
Source Code Evidence Fetched
Jun 04, 2026 - 14:23 vuln.today
Analysis Generated
Jun 04, 2026 - 14:23 vuln.today
CVSS changed
Jun 04, 2026 - 14:22 NVD
7.5 (HIGH)
CVE Published
Jun 04, 2026 - 02:03 nvd
UNKNOWN (no severity yet)

DescriptionCVE.org

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.

The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.

The read may disclose adjacent heap contents into the destination SV.

AnalysisAI

Heap information disclosure in HTML::Entities for Perl (versions before 3.84) allows remote attackers to leak adjacent heap memory contents when decoding entities. The XS routine _decode_entities retains a stale pointer into a hash value SV after grow_gap() reallocates the buffer, causing a use-after-free read that copies freed heap bytes into the output scalar. No public exploit identified at time of analysis and EPSS is very low (0.02%), but the upstream fix is confirmed via GH PR #56.

Technical ContextAI

HTML::Entities is the entity encoding/decoding module bundled with the HTML-Parser CPAN distribution (cpe:2.3:a:oalders:html::entities), implemented in XS (C) for performance. The defect is a CWE-416 Use-After-Free in util.c: decode_entities() calls hv_fetch() on the entity2char hash and caches the value SV's PV pointer in repl, but when the caller-supplied input SV is the same SV as the hash value (self-aliased entity, e.g. a hash entry whose value contains its own key as '&name;'), a subsequent grow_gap() expansion of the input SV's PV reallocates and frees the original allocation that repl still references. The following Copy() loop then reads repl_len bytes from the freed heap region into the destination SV, surfacing whatever the allocator has placed at that address.

RemediationAI

Vendor-released patch: HTML::Entities 3.84 - upgrade the HTML-Parser distribution to 3.84 or later via cpan/cpanm, or apply the distribution-provided update (Debian is tracking the fix across four releases). The upstream commit is 6922552b0778c90a9587a3894e248be4d3a25e1c on https://github.com/libwww-perl/HTML-Parser/pull/56, which changes decode_entities() in util.c to detect self-aliased SVs and copy the entity value into an owned buffer before grow_gap() can realloc the input SV. If immediate upgrade is not possible, avoid passing the same SV as both input and an entity hash value to _decode_entities (i.e. do not call decode with a custom %entities hash whose values reference the same scalar being decoded); restrict any code paths that allow untrusted input to supply or influence the entity2char hash. These workarounds eliminate the trigger but require auditing every caller that uses the second-argument hash override.

More in Html

View all
CVE-2025-15646 CRITICAL
9.8 Jul 01

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element w
CVE-2025-58190 MEDIUM POC
5.3 Feb 05

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can

CVE-2026-57073 CRITICAL
9.1 Jul 16

Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated
CVE-2012-6142 HIGH
7.5 Jun 04

Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows r
CVE-2025-47911 MEDIUM
5.3 Feb 05

Html contains a vulnerability that allows attackers to denial of service (DoS) if an attacker provides specially crafted

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

Debian

libhtml-parser-perl
Release Status Fixed Version Urgency
bullseye vulnerable 3.75-1 -
bookworm vulnerable 3.81-1 -
forky, sid, trixie vulnerable 3.83-1 -
(unstable) fixed (unfixed) -

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-8829 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy