Vulnerability · Published Jun 23, 2025 · Assigned by VulDB
CVE-2025-6498HTACG tidy-html5 alloc.c defaultAlloc memory leak
Low 3.3
In plain English
A low-severity memory leak in tidy-html5 from HTACG. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)0.2%top 85.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | tidy-html5 | no fix listed | DEBIAN-CVE-2025-6498 |
| Debian:13 | tidy-html5 | no fix listed | DEBIAN-CVE-2025-6498 |
| Debian:14 | tidy-html5 | no fix listed | DEBIAN-CVE-2025-6498 |
| Ubuntu:22.04:LTS | tidy-html5 | no fix listed | UBUNTU-CVE-2025-6498 |
| Ubuntu:24.04:LTS | tidy-html5 | no fix listed | UBUNTU-CVE-2025-6498 |
| Ubuntu:25.10 | tidy-html5 | no fix listed | UBUNTU-CVE-2025-6498 |
| Ubuntu:26.04:LTS | tidy-html5 | no fix listed | UBUNTU-CVE-2025-6498 |
| Ubuntu:26.10 | tidy-html5 | no fix listed | UBUNTU-CVE-2025-6498 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HTACG | tidy-html5 | 5.8.0 |
Weakness: CWE-401, CWE-404 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-313614 | HTACG tidy-html5 alloc.c defaultAlloc memory leak vdb-entry, technical-description
- VDB-313614 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #601009 | htacg tidy-html5 tidy-html5 5.8.0 (commit d08ddc2) Memory Leak third-party-advisory
- https://github.com/htacg/tidy-html5/issues/1152 issue-tracking
- https://github.com/user-attachments/files/20438303/tidy-html5_crash_3.txt exploit