[<prev] [next>] [day] [month] [year] [list]
Message-ID: <a28db23e-ff76-424c-9945-8e96a36015c3@cpansec.org>
Date: Mon, 27 Apr 2026 13:31:45 +0100
From: Robert Rothenberg <rrwo@...nsec.org>
To: cve-announce@...urity.metacpan.org, oss-security@...ts.openwall.com
Subject: CVE-2026-7040: Text::Minify::XS versions from v0.3.0 before v0.7.8
for Perl have heap overflow when processing some malformed UTF-8 characters
========================================================================
CVE-2026-7040 CPAN Security Group
========================================================================
CVE ID: CVE-2026-7040
Distribution: Text-Minify-XS
Versions: from v0.3.0 before v0.7.8
MetaCPAN: https://metacpan.org/dist/Text-Minify-XS
VCS Repo: https://github.com/robrwo/Text-Minify-XS
Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have heap
overflow when processing some malformed UTF-8 characters
Description
-----------
Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have a
heap overflow when processing some malformed UTF-8 characters.
The minify functions mishandled some malformed UTF-8 characters,
leading to heap corruption.
Note that the minify_utf8 function is an alias for minnify.
Problem types
-------------
- CWE-176 Improper Handling of Unicode Encoding
- CWE-122 Heap-based Buffer Overflow
Workarounds
-----------
Validate that all strings passed to the minify and minify_utf8
functions.
Solutions
---------
Upgrade to v0.7.8 or later.
References
----------
https://github.com/robrwo/Text-Minify-XS/security/advisories/GHSA-jqhf-vv4h-77h2
https://metacpan.org/release/RRWO/Text-Minify-XS-v0.7.8/changes
Timeline
--------
- 2026-04-23: This issue was identified by CPANSec
- 2025-04-25: Fix uploaded to CPAN
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
