UBUNTU-CVE-2025-15646

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2025-15646
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-15646.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2025-15646
Upstream
Published
2026-07-01T16:16:00Z
Modified
2026-07-09T17:15:09Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.

References

Affected packages

Ubuntu:18.04:LTS / libhtml-gumbo-perl

Package

Name
libhtml-gumbo-perl
Purl
pkg:deb/ubuntu/libhtml-gumbo-perl?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.17-1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhtml-gumbo-perl",
            "binary_version": "0.17-1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-15646.json"

Ubuntu:20.04:LTS / libhtml-gumbo-perl

Package

Name
libhtml-gumbo-perl
Purl
pkg:deb/ubuntu/libhtml-gumbo-perl?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.18-2build1
0.18-2build2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhtml-gumbo-perl",
            "binary_version": "0.18-2build2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-15646.json"

Ubuntu:22.04:LTS / libhtml-gumbo-perl

Package

Name
libhtml-gumbo-perl
Purl
pkg:deb/ubuntu/libhtml-gumbo-perl?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.18-2build3
0.18-2build4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhtml-gumbo-perl",
            "binary_version": "0.18-2build4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-15646.json"

Ubuntu:24.04:LTS / libhtml-gumbo-perl

Package

Name
libhtml-gumbo-perl
Purl
pkg:deb/ubuntu/libhtml-gumbo-perl?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.18-3build1
0.18-3build2
0.18-3build3
0.18-3build4
0.18-3build5

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libhtml-gumbo-perl",
            "binary_version": "0.18-3build5"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-15646.json"