{"id":"CVE-2006-10003","aliases":["ALSA-2026:7679","ALSA-2026:7680","ALSA-2026:7681","AZL-80196","CLSA-2026-1776940444","CLSA-2026-1777396174","DEBIAN-CVE-2006-10003","DSA-6182-1","EUVD-2006-7234","GHSA-x2wr-f89p-cqwh","MGASA-2026-0063","RHSA-2026:7679","RHSA-2026:7680","RHSA-2026:7681","RHSA-2026:8577","RHSA-2026:8578","RHSA-2026:8608","RHSA-2026:8609","RHSA-2026:8610","RHSA-2026:9110","RHSA-2026:9246","RHSA-2026:9258","RHSA-2026:9259","RHSA-2026:9605","RLSA-2026:7679","RLSA-2026:7680","RLSA-2026:7681","SUSE-SU-2026:1152-1","SUSE-SU-2026:1153-1","SUSE-SU-2026:20993-1","UBUNTU-CVE-2006-10003","openSUSE-SU-2026:10527-1","openSUSE-SU-2026:20459-1"],"status":"published","title":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0057,"percentile":0.47444,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-193"],"published":"2026-03-19T11:08:04Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"perl-XML-Parser","fixed_in":["2.47-2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-XML-Parser","fixed_in":["2.46-9.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-XML-Parser","fixed_in":["2.46-9.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libxml-parser-perl","fixed_in":["2.46-4+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxml-parser-perl","fixed_in":["2.47-2~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxml-parser-perl","fixed_in":["2.47-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libxml-parser-perl","fixed_in":["2.46-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libxml-parser-perl","fixed_in":["2.47-1ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libxml-parser-perl","fixed_in":["2.47-1ubuntu0.25.10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:10","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-9.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-9.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-4+deb12u1"}]}],"versions":["2.46-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-2~deb13u1"}]}],"versions":["2.47-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-2"}]}],"versions":["2.47-1","2.47-2~deb13u1"]},{"source":"osv","ecosystem":"Debian:12","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-4+deb12u1"}]}],"versions":["2.46-4"]},{"source":"osv","ecosystem":"Debian:13","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-2~deb13u1"}]}],"versions":["2.47-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.460.0-6.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.41-10.el7_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.41-10.el7_9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-11.el8_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.el10_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_0.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"perl-XML-Parser-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"perl-XML-Parser-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.el9_6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.46-9.1.el9_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:10","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.47-6.1.el10_1"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.44-12.el8_10"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-23.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.41-23.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.44-150000.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.470.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.470.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.41-3","2.44-1","2.44-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.44-2build3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.44-4","2.44-4build1","2.46-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.46-3ubuntu0.1"}]}],"versions":["2.46-2","2.46-2build1","2.46-3","2.46-3build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1ubuntu0.24.04.1"}]}],"versions":["2.46-4","2.47-1","2.47-1build1","2.47-1build2","2.47-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libxml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.47-1ubuntu0.25.10.1"}]}],"versions":["2.47-1build4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.570.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-XML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.470.0-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 10.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.2 advanced update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"},{"vendor":"toddr","product":"xml::parser"},{"vendor":"toddr","product":"xml\\"}],"references":[{"url":"https://rt.cpan.org/Ticket/Display.html?id=19860","tags":["issue-tracking","Mailing List","article"]},{"url":"https://github.com/cpan-authors/XML-Parser/issues/39","tags":["issue-tracking","Issue Tracking","article"]},{"url":"https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch","tags":["patch","Patch","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/03/19/2","tags":["Mailing List","Patch","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00002.html"},{"url":"https://access.redhat.com/security/cve/CVE-2006-10003","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448999","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2006/cve-2006-10003.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8578","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9110","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7680","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7681","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8609","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8608","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8610","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8577","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9246","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9258","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9259","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9605","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7679","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-10003","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-x2wr-f89p-cqwh"},{"url":"https://access.redhat.com/security/cve/CVE-2006-10002","tags":["report"]},{"url":"https://bugzilla.redhat.com/2448999","tags":["report"]},{"url":"https://bugzilla.redhat.com/2449001","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-7679.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-7680.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-7681.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1776940444.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1777396174.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2006-10003","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0063.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35238","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/03/19/1","tags":["web"]},{"url":"https://www.openwall.com/lists/oss-security/2026/03/19/2","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2449001","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7679.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-10002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-10002","tags":["advisory"]},{"url":"https://github.com/cpan-authors/XML-Parser/commit/6b291f4d260fc124a6ec80382b87a918f372bc6b.patch","tags":["article"]},{"url":"https://github.com/cpan-authors/XML-Parser/issues/64","tags":["article"]},{"url":"https://rt.cpan.org/Ticket/Display.html?id=19859","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-10003","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7680.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7681.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8577.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8578.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8608.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8609.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8610.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9110.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9246.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9258.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9259.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9605.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7679","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7680","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:7681","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261152-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1259901","tags":["report"]},{"url":"https://bugzilla.suse.com/1259902","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2006-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-10003","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261153-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620993-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2006-10003","tags":["report"]},{"url":"https://lists.security.metacpan.org/cve-announce/msg/38106362/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8174-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2006-10003","title":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting","status":"published","published":"2026-03-19T11:08:04.341Z","modified":"2026-07-15T01:28:08.168Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-193","CWE-122","CWE-193"],"updated_at":"2026-11-02T14:33:48.500736Z"}],"euvd":[{"id":"EUVD-2006-7234","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting","status":"published","published":"2026-03-19T11:08:04Z","modified":"2026-07-15T01:28:08Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:53.678292Z"}],"ghsa":[{"id":"GHSA-x2wr-f89p-cqwh","title":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in...","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting","status":"published","published":"2026-03-19T12:30:32Z","modified":"2026-06-30T03:35:57Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-122","CWE-193"],"updated_at":"2026-11-02T15:09:04.668745Z"}],"nvd":[{"id":"CVE-2006-10003","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting","status":"published","published":"2026-03-19T12:16:17.047Z","modified":"2026-07-15T02:16:55.277Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-122","CWE-193"],"updated_at":"2026-11-02T14:01:10.996522Z"}],"osv":[{"id":"DEBIAN-CVE-2006-10003","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.  In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.  The bug can be observed when parsing an XML file with very deep element nesting","status":"published","published":"2026-03-19T12:16:17.047Z","modified":"2026-10-23T00:01:06.884504802Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:22.831407Z"},{"id":"RHSA-2026:7679","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-13T10:07:25Z","modified":"2026-06-30T10:54:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7680","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-13T10:07:26Z","modified":"2026-06-30T10:54:30Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7681","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-13T10:07:26Z","modified":"2026-06-30T10:54:31Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:8577","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:46Z","modified":"2026-06-30T10:55:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8578","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:46Z","modified":"2026-06-30T10:55:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8608","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:46Z","modified":"2026-06-30T10:55:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8609","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:47Z","modified":"2026-06-30T10:55:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:8610","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-17T10:09:48Z","modified":"2026-06-30T10:55:22Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:9110","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-21T10:10:58Z","modified":"2026-06-30T10:55:59Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9246","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:15Z","modified":"2026-06-30T10:56:04Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9258","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:15Z","modified":"2026-06-30T10:56:05Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9259","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:15Z","modified":"2026-06-30T10:56:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RHSA-2026:9605","title":"Red Hat Security Advisory: perl-XML-Parser security update","status":"published","published":"2026-04-22T10:11:31Z","modified":"2026-06-30T10:56:21Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"RLSA-2026:7679","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.\n\nSecurity Fix(es):\n\n* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n\n* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:03:53.750171Z","modified":"2026-04-15T12:30:29.596174Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7680","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.\n\nSecurity Fix(es):\n\n* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n\n* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-15T12:07:10.074197Z","modified":"2026-04-15T12:30:40.36418Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:7681","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.\n\nSecurity Fix(es):\n\n* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n\n* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-14T12:01:12.815874Z","modified":"2026-04-14T12:30:06.967415Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2006-10003","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting","status":"published","published":"2026-03-19T12:16:00Z","modified":"2026-06-30T18:15:36.615526099Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:05.838224Z"},{"id":"ALSA-2026:7679","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.  \n\nSecurity Fix(es):  \n\n  * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n  * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:30:10.327000702Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7680","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.  \n\nSecurity Fix(es):  \n\n  * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n  * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:58:18.11574Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:7681","title":"Important: perl-XML-Parser security update","description":"This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.  \n\nSecurity Fix(es):  \n\n  * perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)\n  * perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-10-29T11:02:29.707829308Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-80196","title":"CVE-2006-10003 affecting package perl-XML-Parser for versions less than 2.47-2","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting","status":"published","published":"2026-03-19T12:16:17Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.800038Z"},{"id":"CLSA-2026-1776940444","title":"perl-XML-Parser: Fix of CVE-2006-10003","description":"- CVE-2006-10003: fix off-by-one heap buffer overflow in st_serial_stack\n  growth check in Expat/Expat.xs startElement(); also backport upstream\n  follow-up 2abd177 to initialize st_serial_stacksize=1024 after allocation","status":"published","published":"2026-04-23T10:34:08Z","modified":"2026-06-01T00:32:25.062015359Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777396174","title":"perl-XML-Parser: Fix of CVE-2006-10003","description":"- CVE-2006-10003: fix off-by-one heap buffer overflow in st_serial_stack\n  growth check in Expat/Expat.xs startElement(); also backport upstream\n  follow-up 2abd177 to initialize st_serial_stacksize=1024 after allocation","status":"published","published":"2026-04-28T17:41:36Z","modified":"2026-06-01T00:32:48.906082854Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DSA-6182-1","title":"libxml-parser-perl - security update","status":"published","published":"2026-03-28T00:00:00Z","modified":"2026-03-28T22:31:23.95577Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"MGASA-2026-0063","title":"Updated perl-XML-Parser packages fix security vulnerabilities","description":"XML::Parser versions through 2.47 for Perl could overflow the\npre-allocated buffer size causing a heap corruption (double free or\ncorruption) and crashes. (CVE-2006-10002)\nXML::Parser versions through 2.47 for Perl has an off-by-one heap buffer\noverflow in st_serial_stack. (CVE-2006-10003)\n","status":"published","published":"2026-03-24T17:53:34Z","modified":"2026-04-16T04:44:29.715218297Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10527-1","title":"perl-XML-Parser-2.570.0-1.1 on GA media","description":"These are all security issues fixed in the perl-XML-Parser-2.570.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-10T00:00:00Z","modified":"2026-04-11T08:01:10.60973Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20459-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-04-01T16:23:38Z","modified":"2026-04-05T18:29:14.97305Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:1152-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-03-31T08:28:50Z","modified":"2026-04-01T08:00:11.143353Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:1153-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-03-31T08:40:07Z","modified":"2026-04-01T08:00:10.816577Z","updated_at":"2026-11-02T15:54:01.262144Z"},{"id":"SUSE-SU-2026:20993-1","title":"Security update for perl-XML-Parser","description":"This update for perl-XML-Parser fixes the following issues:\n\n- CVE-2006-10002: heap buffer overflow in `parse_stream` when processing UTF-8 input streams (bsc#1259901).\n- CVE-2006-10003: off-by-one heap buffer overflow in `st_serial_stack` (bsc#1259902).\n","status":"published","published":"2026-04-01T16:24:24Z","modified":"2026-04-10T18:33:44.857042Z","updated_at":"2026-11-02T15:54:01.953589Z"}]}}