Gtermars
Monthly
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.
Memory leak in CSS::Minifier::XS (Perl CPAN module by gtermars) before version 0.14 allows unauthenticated remote attackers to trigger unreleased memory by submitting CSS documents composed entirely of removable content - comments and whitespace. When the minify() function processes such input and the entire document is consumed by the minification pass, the underlying XS (C extension) layer fails to release the allocated memory, satisfying CWE-401. The Information Disclosure tag and C:L CVSS rating suggest leaked heap contents may expose sensitive in-process data, though the more immediate risk is incremental memory exhaustion in long-running web services. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) reflects minimal observed exploitation interest.
Uncontrolled memory consumption in the Perl module JavaScript::Minifier::XS before version 0.16 lets remote attackers exhaust a long-lived process's memory by repeatedly triggering minify() calls. The XS cleanup code frees only the NodeSet structures while leaking every per-token contents buffer (and the entire NodeSet on the empty-list early-return paths), so each invocation leaks heap memory until the process is OOM-killed. CISA's SSVC marks exploitation as automatable with partial technical impact; no public exploit has been identified and it is not in CISA KEV, though the leak is trivially reachable in any service that minifies attacker-supplied JavaScript.
Denial of service in JavaScript::Minifier::XS before 0.16 (a Perl XS module) lets remote attackers crash any service that minifies untrusted JavaScript by supplying input whose first meaningful token is a slash - as little as a single '/' byte. The flaw is a NULL pointer dereference (CWE-476) reachable directly through the public minify() API, terminating the calling process. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.49%, 38th percentile), consistent with a crash-only availability bug rather than a code-execution target.
Memory leak in CSS::Minifier::XS (Perl CPAN module by gtermars) before version 0.14 allows unauthenticated remote attackers to trigger unreleased memory by submitting CSS documents composed entirely of removable content - comments and whitespace. When the minify() function processes such input and the entire document is consumed by the minification pass, the underlying XS (C extension) layer fails to release the allocated memory, satisfying CWE-401. The Information Disclosure tag and C:L CVSS rating suggest leaked heap contents may expose sensitive in-process data, though the more immediate risk is incremental memory exhaustion in long-running web services. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) reflects minimal observed exploitation interest.