CVE-2026-7040: Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have heap overflow when processing some malformed UTF-8 characters
Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters.
The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption.
Note that the minifyutf8 function is an alias for minify.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Text::Minify::XS (Perl)to a version that resolves this vulnerability.Fixed in 0.7.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7040?
CVE-2026-7040 is classified as a high severity vulnerability due to the potential for heap overflow, which could lead to arbitrary code execution.
Which versions of Text::Minify::XS are affected by CVE-2026-7040?
CVE-2026-7040 affects Text::Minify::XS versions from 0.3.0 to 0.7.8.
How do I fix CVE-2026-7040?
To fix CVE-2026-7040, upgrade to Text::Minify::XS version 0.7.8 or later.
What causes CVE-2026-7040?
CVE-2026-7040 is caused by the mishandling of malformed UTF-8 characters during processing.
Can CVE-2026-7040 lead to data loss?
Yes, CVE-2026-7040 can lead to data loss or corruption due to the heap overflow vulnerability.