UBUNTU-CVE-2026-56018

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-56018

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-56018

Upstream

CVE-2026-56018

Published

2026-06-29T20:17:00Z

Modified

2026-07-01T21:27:56Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

JavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the two early returns taken when the node list is empty leak the whole NodeSet. A long-lived process that minifies repeatedly, such as an asset pipeline or a server-side minifier endpoint, grows in memory without bound until it exhausts available memory and is killed, causing denial of service.

References

Affected packages

Ubuntu:16.04:LTS

libjavascript-minifier-xs-perl

Package

Name: libjavascript-minifier-xs-perl
Purl: pkg:deb/ubuntu/libjavascript-minifier-xs-perl?arch=source&distro=xenial

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.11-1

0.11-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjavascript-minifier-xs-perl",
            "binary_version": "0.11-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json"

Ubuntu:18.04:LTS

libjavascript-minifier-xs-perl

Package

Name: libjavascript-minifier-xs-perl
Purl: pkg:deb/ubuntu/libjavascript-minifier-xs-perl?arch=source&distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.11-1build3

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjavascript-minifier-xs-perl",
            "binary_version": "0.11-1build3"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json"

Ubuntu:20.04:LTS

libjavascript-minifier-xs-perl

Package

Name: libjavascript-minifier-xs-perl
Purl: pkg:deb/ubuntu/libjavascript-minifier-xs-perl?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.11-1build4

0.11-1build5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjavascript-minifier-xs-perl",
            "binary_version": "0.11-1build5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json"

Ubuntu:22.04:LTS

libjavascript-minifier-xs-perl

Package

Name: libjavascript-minifier-xs-perl
Purl: pkg:deb/ubuntu/libjavascript-minifier-xs-perl?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.13-1

0.15-1

0.15-1build1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjavascript-minifier-xs-perl",
            "binary_version": "0.15-1build1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json"

Ubuntu:24.04:LTS

libjavascript-minifier-xs-perl

Package

Name: libjavascript-minifier-xs-perl
Purl: pkg:deb/ubuntu/libjavascript-minifier-xs-perl?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.15-1build2

0.15-1build3

0.15-1build4

0.15-1build5

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjavascript-minifier-xs-perl",
            "binary_version": "0.15-1build5"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json"

Ubuntu:25.10

libjavascript-minifier-xs-perl

Package

Name: libjavascript-minifier-xs-perl
Purl: pkg:deb/ubuntu/libjavascript-minifier-xs-perl?arch=source&distro=questing

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.15-1build6

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjavascript-minifier-xs-perl",
            "binary_version": "0.15-1build6"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json"

Ubuntu:26.04:LTS

libjavascript-minifier-xs-perl

Package

Name: libjavascript-minifier-xs-perl
Purl: pkg:deb/ubuntu/libjavascript-minifier-xs-perl?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

0.*

0.15-1build6

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libjavascript-minifier-xs-perl",
            "binary_version": "0.15-1build6"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-56018.json"