HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.
The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.
The read may disclose adjacent heap contents into the destination SV.
References
| Link | Resource |
|---|---|
| https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch | Patch |
| https://github.com/libwww-perl/HTML-Parser/pull/56 | Issue Tracking Patch |
| http://www.openwall.com/lists/oss-security/2026/06/04/2 | Mailing List Third Party Advisory |
Configurations
History
08 Jun 2026, 16:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch - Patch | |
| References | () https://github.com/libwww-perl/HTML-Parser/pull/56 - Issue Tracking, Patch | |
| References | () http://www.openwall.com/lists/oss-security/2026/06/04/2 - Mailing List, Third Party Advisory | |
| First Time |
Oalders html\
Oalders |
|
| CPE | cpe:2.3:a:oalders:html\:\:entities:*:*:*:*:*:perl:*:* |
04 Jun 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
04 Jun 2026, 07:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
04 Jun 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-04 03:16
Updated : 2026-06-08 16:29
NVD link : CVE-2026-8829
Mitre link : CVE-2026-8829
CVE.ORG link : CVE-2026-8829
JSON object : View
Products Affected
oalders
- html\
CWE
CWE-416
Use After Free