Vulnerability-Lookup

OESA-2026-2672 (CVE-2026-8829)

Vulnerability from osv_openeuler – Published: 2026-06-12 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

perl-HTML-Parser security update

Details

Objects of the HTML::Parser class will recognize markup and separate it from plain text (alias data content) in HTML documents. As different kinds of markup and text are recognized, the corresponding event handlers are invoked.

Security Fix(es):

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.

The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.

The read may disclose adjacent heap contents into the destination SV.(CVE-2026-8829)

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-8829	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-HTML-Parser-3.81-2.oe2403sp1.aarch64.rpm",
          "perl-HTML-Parser-debuginfo-3.81-2.oe2403sp1.aarch64.rpm",
          "perl-HTML-Parser-debugsource-3.81-2.oe2403sp1.aarch64.rpm",
          "perl-HTML-Parser-help-3.81-2.oe2403sp1.aarch64.rpm"
        ],
        "src": [
          "perl-HTML-Parser-3.81-2.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "perl-HTML-Parser-3.81-2.oe2403sp1.x86_64.rpm",
          "perl-HTML-Parser-debuginfo-3.81-2.oe2403sp1.x86_64.rpm",
          "perl-HTML-Parser-debugsource-3.81-2.oe2403sp1.x86_64.rpm",
          "perl-HTML-Parser-help-3.81-2.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "perl-HTML-Parser",
        "purl": "pkg:rpm/openEuler/perl-HTML-Parser\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.81-2.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-HTML-Parser-3.81-2.oe2403sp3.aarch64.rpm",
          "perl-HTML-Parser-debuginfo-3.81-2.oe2403sp3.aarch64.rpm",
          "perl-HTML-Parser-debugsource-3.81-2.oe2403sp3.aarch64.rpm",
          "perl-HTML-Parser-help-3.81-2.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "perl-HTML-Parser-3.81-2.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "perl-HTML-Parser-3.81-2.oe2403sp3.x86_64.rpm",
          "perl-HTML-Parser-debuginfo-3.81-2.oe2403sp3.x86_64.rpm",
          "perl-HTML-Parser-debugsource-3.81-2.oe2403sp3.x86_64.rpm",
          "perl-HTML-Parser-help-3.81-2.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "perl-HTML-Parser",
        "purl": "pkg:rpm/openEuler/perl-HTML-Parser\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.81-2.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-HTML-Parser-3.73-2.oe2003sp4.aarch64.rpm",
          "perl-HTML-Parser-debuginfo-3.73-2.oe2003sp4.aarch64.rpm",
          "perl-HTML-Parser-debugsource-3.73-2.oe2003sp4.aarch64.rpm",
          "perl-HTML-Parser-help-3.73-2.oe2003sp4.aarch64.rpm"
        ],
        "src": [
          "perl-HTML-Parser-3.73-2.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "perl-HTML-Parser-3.73-2.oe2003sp4.x86_64.rpm",
          "perl-HTML-Parser-debuginfo-3.73-2.oe2003sp4.x86_64.rpm",
          "perl-HTML-Parser-debugsource-3.73-2.oe2003sp4.x86_64.rpm",
          "perl-HTML-Parser-help-3.73-2.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "perl-HTML-Parser",
        "purl": "pkg:rpm/openEuler/perl-HTML-Parser\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.73-2.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-HTML-Parser-3.78-2.oe2203sp4.aarch64.rpm",
          "perl-HTML-Parser-debuginfo-3.78-2.oe2203sp4.aarch64.rpm",
          "perl-HTML-Parser-debugsource-3.78-2.oe2203sp4.aarch64.rpm",
          "perl-HTML-Parser-help-3.78-2.oe2203sp4.aarch64.rpm"
        ],
        "src": [
          "perl-HTML-Parser-3.78-2.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "perl-HTML-Parser-3.78-2.oe2203sp4.x86_64.rpm",
          "perl-HTML-Parser-debuginfo-3.78-2.oe2203sp4.x86_64.rpm",
          "perl-HTML-Parser-debugsource-3.78-2.oe2203sp4.x86_64.rpm",
          "perl-HTML-Parser-help-3.78-2.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "perl-HTML-Parser",
        "purl": "pkg:rpm/openEuler/perl-HTML-Parser\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.78-2.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "Objects of the HTML::Parser class will recognize markup and separate it from plain text (alias data content) in HTML documents. As different kinds of markup and text are recognized, the corresponding event handlers are invoked.\r\n\r\nSecurity Fix(es):\n\nHTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV\u0026apos;s PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.(CVE-2026-8829)",
  "id": "OESA-2026-2672",
  "modified": "2026-08-06T11:11:36Z",
  "published": "2026-06-12T11:11:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2672"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8829"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "perl-HTML-Parser security update",
  "upstream": [
    "CVE-2026-8829"
  ]
}

CVE-2026-8829 (GCVE-0-2026-8829)

Vulnerability from cvelistv5 – Published: 2026-06-04 02:03 – Updated: 2026-06-28 11:34

Title

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

Summary

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation. The read may disclose adjacent heap contents into the destination SV.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-04 12:59 UTC

CWE

CWE-416 - Use After Free

Assigner

CPANSec redhat root Scorecard

References

4 references

URL	Tags
https://github.com/libwww-perl/HTML-Parser/pull/56	patch
https://github.com/libwww-perl/HTML-Parser/commit…	patch
http://www.openwall.com/lists/oss-security/2026/06/04/2
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
OALDERS	HTML::Entities	Affected: 0 , < 3.84 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-28T11:34:26.121Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/04/2"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/06/msg00044.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-8829",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T12:59:04.771815Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-04T12:59:07.698Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "HTML-Parser",
          "product": "HTML::Entities",
          "programFiles": [
            "util.c"
          ],
          "programRoutines": [
            {
              "name": "HTML::Entities::_decode_entities"
            }
          ],
          "repo": "https://github.com/libwww-perl/HTML-Parser",
          "vendor": "OALDERS",
          "versions": [
            {
              "lessThan": "3.84",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV\u0027s PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T02:03:46.702Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/libwww-perl/HTML-Parser/pull/56"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to HTML-Parser 3.84 or later."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-12T00:00:00.000Z",
          "value": "Issue reported."
        },
        {
          "lang": "en",
          "time": "2026-05-19T00:00:00.000Z",
          "value": "HTML-Parser 3.84 released."
        }
      ],
      "title": "HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-8829",
    "datePublished": "2026-06-04T02:03:46.702Z",
    "dateReserved": "2026-05-18T13:24:05.252Z",
    "dateUpdated": "2026-06-28T11:34:26.121Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

OESA-2026-2672 (CVE-2026-8829)

CVE-2026-8829 (GCVE-0-2026-8829)

Tags

Sightings

Nomenclature

Related by attack behaviour