VULNERABILITY INTELLIGENCE

CVE-2026-8177

CVSS score7.5 HIGH
EPSS probability0.65%
CISA KEVNot currently listed
Published2026-05-10
Last modified2026-09-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

Weakness classification

  • 9b29abf9-4ab0-4765-b253-1875cd9b441e: CWE-125
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-125

Primary references