CVE-2025-15646: HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.
Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walktree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.
Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTML::Gumbo (Perl)to a version that resolves this vulnerability.Fixed in 0.19Patch CVE-2025-15646
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15646?
CVE-2025-15646 has a severity rating of critical with a CVSS score of 9.8.
How do I fix CVE-2025-15646?
To mitigate CVE-2025-15646, upgrade HTML::Gumbo to version 0.19 or later.
What versions of HTML::Gumbo are affected by CVE-2025-15646?
HTML::Gumbo versions prior to 0.19 are vulnerable to CVE-2025-15646.
What type of vulnerability is CVE-2025-15646?
CVE-2025-15646 is a heap memory disclosure vulnerability caused by type confusion.
What impact does CVE-2025-15646 have on systems?
CVE-2025-15646 can lead to sensitive data exposure due to the improper handling of the <template> element.