Skip to main content

tidy-html5 EUVDEUVD-2025-18860

| CVE-2025-6497 LOW
Reachable Assertion (CWE-617)
2025-06-23 cna@vuldb.com
Denial Of Service
1.9
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
1.9 LOW
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
3.3 LOW

Local attack, low complexity, low privileges, no user interaction, only availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ubuntu
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

5
CVSS changed
Apr 29, 2026 - 01:11 NVD
3.3 (LOW) 1.9 (LOW)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
EUVD ID Assigned
Mar 15, 2026 - 22:10 euvd
EUVD-2025-18860
Analysis Generated
Mar 15, 2026 - 22:10 vuln.today
CVE Published
Jun 23, 2025 - 01:15 nvd
LOW 3.3

DescriptionCVE.org

A vulnerability was found in HTACG tidy-html5 5.8.0. It has been rated as problematic. This issue affects the function prvTidyParseNamespace of the file src/parser.c. The manipulation leads to reachable assertion. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

AnalysisAI

Denial of service in tidy-html5 5.8.0 via reachable assertion in prvTidyParseNamespace allows local attackers to crash the application. A public exploit exists but no active exploitation has been reported; EPSS score is low (0.02%).

Technical ContextAI

The vulnerability is a reachable assertion (CWE-617) in the HTML/XML parser library tidy-html5, specifically in the function prvTidyParseNamespace in src/parser.c. The library is used for cleaning up and formatting HTML/XML documents. The assertion failure causes the program to abort, leading to denial of service. CPE data confirms affected version is tidy-html5 5.8.0.

RemediationAI

Upgrade to the latest patched version of tidy-html5 from the vendor's repository. The fix is available from the vendor; refer to the GitHub issue for details. As a workaround, restrict local access to the tidy-html5 binary to trusted users only, since exploitation requires local access. Note that this may not be feasible in all environments.

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
tidy-html5
Release Status Version
upstream needs-triage -
bionic deferred 2026-03-11
focal deferred 2026-03-11
jammy deferred 2026-03-11
noble deferred 2026-03-11
oracular ignored end of life, was deferred [2026-03-11]
plucky ignored end of life, was deferred [2026-03-11]
questing deferred 2026-03-11

Debian

Bug #1108234
tidy-html5
Release Status Fixed Version Urgency
bookworm, bullseye vulnerable 2:5.6.0-11 -
trixie vulnerable 2:5.8.0-2 -
forky, sid vulnerable 2:5.8.0-2.1 -
(unstable) fixed (unfixed) -

Share

EUVD-2025-18860 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy