CVE-2025-15646 (GCVE-0-2025-15646)

Vulnerability from cvelistv5 – Published: 2026-07-01 14:38 – Updated: 2026-07-01 18:09
VLAI
Title
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion
Summary
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: yes Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-01 18:08 UTC
CWE
  • CWE-843 - Access of Resource Using Incompatible Type (Type Confusion)
  • CWE-125 - Out-of-bounds Read
Assigner
References
Impacted products
Vendor Product Version CPE status
BPS HTML::Gumbo Affected: 0 , < 0.19 (custom)
guessed Create a notification for this product.
Credits
Vincent Lefevre Niko Tyni
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-01T17:36:44.275Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/01/7"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-15646",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-01T18:08:40.682429Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-01T18:09:08.371Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "HTML-Gumbo",
          "product": "HTML::Gumbo",
          "programFiles": [
            "lib/HTML/Gumbo.xs"
          ],
          "programRoutines": [
            {
              "name": "walk_tree"
            }
          ],
          "repo": "https://github.com/bestpractical/HTML-Gumbo",
          "vendor": "BPS",
          "versions": [
            {
              "lessThan": "0.19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vincent Lefevre"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Niko Tyni"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.\n\nSupport for the \u003ctemplate\u003e element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.\n\nAny caller that runs parse() with the default format =\u003e \u0027string\u0027, or with format =\u003e \u0027tree\u0027, on input containing a \u003ctemplate\u003e element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format =\u003e \u0027callback\u0027 reaches a croak on the unhandled node type and is unaffected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "CWE-843 Access of Resource Using Incompatible Type (Type Confusion)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125 Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-01T14:38:03.727Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/BPS/HTML-Gumbo-0.19/changes"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://bugs.debian.org/1104789"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to HTML-Gumbo 0.19 or later, which adds GUMBO_NODE_TEMPLATE to the container node types handled by walk_tree."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2015-04-30T00:00:00.000Z",
          "value": "Gumbo 0.10.0 released with support for the \u003ctemplate\u003e element."
        },
        {
          "lang": "en",
          "time": "2025-05-06T00:00:00.000Z",
          "value": "Reported to the Debian bug tracker (#1104789)."
        },
        {
          "lang": "en",
          "time": "2025-05-17T00:00:00.000Z",
          "value": "Fix committed upstream."
        },
        {
          "lang": "en",
          "time": "2026-05-21T00:00:00.000Z",
          "value": "Version 0.19 released with fix."
        }
      ],
      "title": "HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2025-15646",
    "datePublished": "2026-07-01T14:38:03.727Z",
    "dateReserved": "2026-05-22T10:47:01.107Z",
    "dateUpdated": "2026-07-01T18:09:08.371Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-15646",
      "date": "2026-09-30",
      "epss": "0.00671",
      "percentile": "0.50162"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://cpan.org/modules",
                "defaultStatus": "unaffected",
                "packageName": "HTML-Gumbo",
                "product": "HTML::Gumbo",
                "programFiles": [
                  "lib/HTML/Gumbo.xs"
                ],
                "programRoutines": [
                  {
                    "name": "walk_tree"
                  }
                ],
                "repo": "https://github.com/bestpractical/HTML-Gumbo",
                "vendor": "BPS",
                "versions": [
                  {
                    "lessThan": "0.19",
                    "status": "affected",
                    "version": "0",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.\n\nSupport for the \u003ctemplate\u003e element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.\n\nAny caller that runs parse() with the default format =\u003e \u0027string\u0027, or with format =\u003e \u0027tree\u0027, on input containing a \u003ctemplate\u003e element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format =\u003e \u0027callback\u0027 reaches a croak on the unhandled node type and is unaffected."
          },
          {
            "lang": "es",
            "value": "Las versiones de HTML::Gumbo anteriores a la 0.19 para Perl revelan memoria del heap a trav\u00e9s de confusi\u00f3n de tipos.\n\nEl soporte para el elemento \u003ctemplate\u003e se a\u00f1adi\u00f3 a libgumbo 0.10.0 en 2015, pero la funci\u00f3n walk_tree en lib/HTML/Gumbo.xs no se actualiz\u00f3 para soportarlo. El elemento fue tratado como un nodo de texto, donde strlen() lee m\u00e1s all\u00e1 del bloque del heap al que apunta el puntero.\n\nCualquier llamador que ejecute parse() con el formato predeterminado =\u003e \u0027string\u0027, o con formato =\u003e \u0027tree\u0027, en una entrada que contenga un elemento \u003ctemplate\u003e serializa los bytes le\u00eddos en exceso en el resultado devuelto, revelando contenidos acotados del heap. formato =\u003e \u0027callback\u0027 alcanza un croak en el tipo de nodo no manejado y no se ve afectado."
          }
        ],
        "id": "CVE-2025-15646",
        "lastModified": "2026-09-30T21:10:00.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-15646",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-01T18:08:40.682429Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-01T16:16:29.657",
        "references": [
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://bugs.debian.org/1104789"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch"
          },
          {
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "url": "https://metacpan.org/release/BPS/HTML-Gumbo-0.19/changes"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2026/07/01/7"
          }
        ],
        "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              },
              {
                "lang": "en",
                "value": "CWE-843"
              }
            ],
            "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-07-02T13:50:23+00:00",
      "cve": "CVE-2025-15646",
      "id": "CVE-2025-15646",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "HTML-Gumbo: HTML::Gumbo: Information disclosure through HTML template processing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-15646.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-07-01T17:36:44.275Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/07/01/7"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "HIGH",
                  "baseScore": 9.8,
                  "baseSeverity": "CRITICAL",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "HIGH",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-15646",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-01T18:08:40.682429Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-01T18:08:56.699Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://cpan.org/modules",
              "defaultStatus": "unaffected",
              "packageName": "HTML-Gumbo",
              "product": "HTML::Gumbo",
              "programFiles": [
                "lib/HTML/Gumbo.xs"
              ],
              "programRoutines": [
                {
                  "name": "walk_tree"
                }
              ],
              "repo": "https://github.com/bestpractical/HTML-Gumbo",
              "vendor": "BPS",
              "versions": [
                {
                  "lessThan": "0.19",
                  "status": "affected",
                  "version": "0",
                  "versionType": "custom"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Vincent Lefevre"
            },
            {
              "lang": "en",
              "type": "remediation developer",
              "value": "Niko Tyni"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.\n\nSupport for the \u003ctemplate\u003e element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.\n\nAny caller that runs parse() with the default format =\u003e \u0027string\u0027, or with format =\u003e \u0027tree\u0027, on input containing a \u003ctemplate\u003e element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format =\u003e \u0027callback\u0027 reaches a croak on the unhandled node type and is unaffected."
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-843",
                  "description": "CWE-843 Access of Resource Using Incompatible Type (Type Confusion)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-125",
                  "description": "CWE-125 Out-of-bounds Read",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-01T14:38:03.727Z",
            "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
            "shortName": "CPANSec"
          },
          "references": [
            {
              "tags": [
                "patch"
              ],
              "url": "https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch"
            },
            {
              "tags": [
                "release-notes"
              ],
              "url": "https://metacpan.org/release/BPS/HTML-Gumbo-0.19/changes"
            },
            {
              "tags": [
                "issue-tracking"
              ],
              "url": "https://bugs.debian.org/1104789"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "value": "Upgrade to HTML-Gumbo 0.19 or later, which adds GUMBO_NODE_TEMPLATE to the container node types handled by walk_tree."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2015-04-30T00:00:00.000Z",
              "value": "Gumbo 0.10.0 released with support for the \u003ctemplate\u003e element."
            },
            {
              "lang": "en",
              "time": "2025-05-06T00:00:00.000Z",
              "value": "Reported to the Debian bug tracker (#1104789)."
            },
            {
              "lang": "en",
              "time": "2025-05-17T00:00:00.000Z",
              "value": "Fix committed upstream."
            },
            {
              "lang": "en",
              "time": "2026-05-21T00:00:00.000Z",
              "value": "Version 0.19 released with fix."
            }
          ],
          "title": "HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion",
          "x_generator": {
            "engine": "cpansec-cna-tool 0.1"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "assignerShortName": "CPANSec",
        "cveId": "CVE-2025-15646",
        "datePublished": "2026-07-01T14:38:03.727Z",
        "dateReserved": "2026-05-22T10:47:01.107Z",
        "dateUpdated": "2026-07-01T18:09:08.371Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.