CVE-2025-15646

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-15646

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15646.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-15646

Downstream

Published

2026-07-01T14:38:03Z

Modified

2026-10-28T02:31:13Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion

Details

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.

Support for the element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.

Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.

Database specific

{
    "cna_assigner": "CPANSec",
    "cwe_ids": [
        "CWE-125",
        "CWE-843"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15646.json"
}

References

Affected packages

Git / github.com/bestpractical/html-gumbo

Affected ranges

Type

GIT

Repo

https://github.com/bestpractical/html-gumbo

Events

Introduced

Fixed

e245984553cdbe3a85f2e250d976c1ff8abad921

Fixed

15c0598909d4a64f47ef0a1abc5051f4e113c186

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.19"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "15c0598909d4a64f47ef0a1abc5051f4e113c186"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.11

0.12

0.16

0.17

0.18

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-15646.json"