https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 15:53:54 +0000 https://cve.radiocsirt.org/vuln/cve-2025-15646 <p><strong>Affected:</strong> BPS HTML::Gumbo</p> <p>HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.</p> <p>Support for the &lt;template&gt; element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.</p> <p>Any caller that runs parse() with the default format =&gt; &#39;string&#39;, or with format =&gt; &#39;tree&#39;, on input containing a &lt;template&gt; element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format =&gt; &#39;callback&#39; reaches a croak on the unhandled node type and is unaffected.</p> <p><strong>Affected:</strong> BPS HTML::Gumbo</p> <p>HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.</p> <p>Support for the &lt;template&gt; element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.</p> <p>Any caller that runs parse() with the default format =&gt; &#39;string&#39;, or with format =&gt; &#39;tree&#39;, on input containing a &lt;template&gt; element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format =&gt; &#39;callback&#39; reaches a croak on the unhandled node type and is unaffected.</p> https://cve.radiocsirt.org/vuln/cve-2025-15646