Skip to content
Fencer Vulns
critical 9.8

CVE-2025-15646 json

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion

published 2026-07-01 4 mo ago modified 2026-10-06 33 d ago also EUVD-2025-210396

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.

Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.

Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.

Patch / fix

  • BPS HTML::Gumbo 0.19
  • libhtml-gumbo-perl Debian 12 0.18-3+deb12u1
  • libhtml-gumbo-perl Debian 14, Debian 13 0.18-5

debian advisories DEBIAN-CVE-2025-15646

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-15646 updated cvss 7.5

HTML-Gumbo: HTML::Gumbo: Information disclosure through HTML template processing

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
4 mo ago

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • BPS HTML::Gumbo

Classification

Weakness
  • CWE-843 Access of Resource Using Incompatible Type
  • CWE-125 Out-of-bounds Read

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.