Vulnerability Description
HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation. The read may disclose adjacent heap contents into the destination SV.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Oalders | Html\ | < 3.84, \ |
Related Weaknesses (CWE)
References
- https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248bPatch
- https://github.com/libwww-perl/HTML-Parser/pull/56Issue TrackingPatch
- http://www.openwall.com/lists/oss-security/2026/06/04/2Mailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2026/06/msg00044.html
FAQ
What is CVE-2026-8829?
CVE-2026-8829 is a vulnerability with a CVSS score of 7.5 (HIGH). HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV retur...
How severe is CVE-2026-8829?
CVE-2026-8829 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-8829?
Check the references section above for vendor advisories and patch information. Affected products include: Oalders Html\.