XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.
In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.
The bug can be observed when parsing an XML file with very deep element nesting
References
| Link | Resource |
|---|---|
| https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch | Patch |
| https://github.com/cpan-authors/XML-Parser/issues/39 | Issue Tracking |
| https://rt.cpan.org/Ticket/Display.html?id=19860 | Mailing List |
| http://www.openwall.com/lists/oss-security/2026/03/19/2 | Mailing List Patch Third Party Advisory |
Configurations
History
19 Mar 2026, 18:41
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:toddr:xml\:\:parser:*:*:*:*:*:perl:*:* | |
| First Time |
Toddr xml\
Toddr |
|
| References | () https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch - Patch | |
| References | () https://github.com/cpan-authors/XML-Parser/issues/39 - Issue Tracking | |
| References | () https://rt.cpan.org/Ticket/Display.html?id=19860 - Mailing List | |
| References | () http://www.openwall.com/lists/oss-security/2026/03/19/2 - Mailing List, Patch, Third Party Advisory |
19 Mar 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
19 Mar 2026, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-19 12:16
Updated : 2026-03-19 18:41
NVD link : CVE-2006-10003
Mitre link : CVE-2006-10003
CVE.ORG link : CVE-2006-10003
JSON object : View
Products Affected
toddr
- xml\