Vulnerability · Published Jul 1, 2026 · Assigned by CPANSec
CVE-2025-15646HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion
Critical 9.8
In plain English
A critical-severity type confusion in HTML::Gumbo from BPS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | libhtml-gumbo-perl | 0.18-3+deb12u1 | DEBIAN-CVE-2025-15646 |
| Debian:13 | libhtml-gumbo-perl | 0.18-5 | DEBIAN-CVE-2025-15646 |
| Debian:14 | libhtml-gumbo-perl | 0.18-5 | DEBIAN-CVE-2025-15646 |
| Ubuntu:22.04:LTS | libhtml-gumbo-perl | no fix listed | UBUNTU-CVE-2025-15646 |
| Ubuntu:24.04:LTS | libhtml-gumbo-perl | no fix listed | UBUNTU-CVE-2025-15646 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BPS | HTML::Gumbo | 0 – before 0.19 |
Weakness: CWE-843, CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H