CVE-2025-15646 HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion
Attackers can disclose bounded heap memory by providing HTML containing a template element to the HTML::Gumbo Perl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-15646?
CVE-2025-15646 is a critical vulnerability in BPS HTML::Gumbo, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.
Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.
Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.
Which versions are affected by CVE-2025-15646?
How do I fix CVE-2025-15646?
Upgrade to a fixed version.
Is CVE-2025-15646 being exploited?
There is no known exploitation of CVE-2025-15646 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-15646, GHSA-754r-h5mg-r795, UBUNTU-CVE-2025-15646.