CVE-2026-8829 HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities
An attacker can trigger a use-after-free in HTML::Entities to disclose adjacent heap memory contents via crafted entity references.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8829?
CVE-2026-8829 is a high-severity use after free vulnerability in OALDERS HTML::Entities, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.
The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.
The read may disclose adjacent heap contents into the destination SV.
Weakness: CWE-416
Which versions are affected by CVE-2026-8829?
It affects 1 product.
Linux distribution packages (6)
perl-HTML-Parser SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.830.0-150000.3.6.1 |
perl-HTML-Parser SUSE:Linux Enterprise Server 16.0 | All versions | 3.830.0-160000.3.1 |
perl-HTML-Parser SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 3.71-3.3.1 |
perl-HTML-Parser SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.830.0-160000.3.1 |
perl-HTML-Parser openSUSE:Leap 16.0 | All versions | 3.830.0-160000.3.1 |
perl-HTML-Parser openSUSE:Tumbleweed | All versions | 3.850.0-1.1 |
Products include Oalders Html\.
How do I fix CVE-2026-8829?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-8829 being exploited?
There is no known exploitation of CVE-2026-8829 in the wild and no public exploit code.
Sources
Also known as AZL-89451, BELL-CVE-2026-8829, DEBIAN-CVE-2026-8829, ECHO-a119-605d-66fd, GHSA-9p7j-9995-m88w, MGASA-2026-0264 and 8 more.