Follow @Openwall on Twitter for new release announcements and other news
[<prev] [day] [month] [year] [list] 
Message-Id: <411A28FF-F12F-46AD-9A96-E4764E447C2A@stig.io>
Date: Sun, 10 May 2026 22:55:28 +0200
From: Stig Palmquist <stig@...g.io>
To: cve-announce@...urity.metacpan.org,
 oss-security@...ts.openwall.com
Subject: CVE-2026-8177: XML::LibXML versions through 2.0210 for Perl read
 out-of-bounds heap memory when parsing XML node names containing truncated
 UTF-8 byte sequences

========================================================================
CVE-2026-8177                                        CPAN Security Group
========================================================================

        CVE ID:  CVE-2026-8177
  Distribution:  XML-LibXML
      Versions:  through 2.0210

      MetaCPAN:  https://metacpan.org/dist/XML-LibXML
      VCS Repo:  https://github.com/cpan-authors/XML-LibXML


XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap
memory when parsing XML node names containing truncated UTF-8 byte
sequences

Description
-----------
XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap
memory when parsing XML node names containing truncated UTF-8 byte
sequences.

A node name ending in the middle of a multi byte UTF-8 sequence causes
the parser to read past the end of the input string into adjacent heap
memory.

Any Perl process that passes attacker controlled strings to
XML::LibXML's DOM node-name methods can reach this path on the default
API. The likely consequence is a crash, causing denial of service.

Problem types
-------------
- CWE-125 Out-of-bounds Read

Solutions
---------
Upgrade to a future XML::LibXML release, or apply the upstream patch.


References
----------
https://github.com/cpan-authors/XML-LibXML/issues/146
https://github.com/cpan-authors/XML-LibXML/commit/15652bd905a6c9dda59a81b14d4766adbbae2ea8.patch

Timeline
--------
- 2026-05-08: Upstream fix merged.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.