{"id":"CVE-2026-8829","aliases":["AZL-89451","BELL-CVE-2026-8829","DEBIAN-CVE-2026-8829","EUVD-2026-34194","GHSA-9p7j-9995-m88w","MGASA-2026-0264","OESA-2026-2672","SUSE-SU-2026:22189-1","SUSE-SU-2026:2948-1","SUSE-SU-2026:2950-1","UBUNTU-CVE-2026-8829","USN-8587-1","openSUSE-SU-2026:10957-1","openSUSE-SU-2026:21126-1"],"status":"published","title":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00408,"percentile":0.35412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-06-04T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"perl-HTML-Parser","fixed_in":["3.82-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"perl-html-parser","fixed_in":["3.80-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"perl-html-parser","fixed_in":["3.83-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"perl-html-parser","fixed_in":["3.83-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libhtml-parser-perl","fixed_in":["3.81-1+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libhtml-parser-perl","fixed_in":["3.83-2~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libhtml-parser-perl","fixed_in":["3.83-2"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"perl-HTML-Parser","fixed_in":["3.830.0-3.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"perl-HTML-Parser","fixed_in":["3.810.0-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-HTML-Parser","fixed_in":["3.81-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-HTML-Parser","fixed_in":["3.81-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-HTML-Parser","fixed_in":["3.73-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-HTML-Parser","fixed_in":["3.78-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-HTML-Parser","fixed_in":["3.830.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-HTML-Parser","fixed_in":["3.830.0-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-HTML-Parser","fixed_in":["3.71-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-HTML-Parser","fixed_in":["3.830.0-150000.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libhtml-parser-perl","fixed_in":["3.76-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libhtml-parser-perl","fixed_in":["3.81-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libhtml-parser-perl","fixed_in":["3.83-1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-HTML-Parser","fixed_in":["3.850.0-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"perl-HTML-Parser","fixed_in":["3.830.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.82-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"perl-html-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.80-r0"},{"fixed":"3.80-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"perl-html-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.83-r0"},{"fixed":"3.83-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"perl-html-parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.80-r0"},{"fixed":"3.83-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.81-1+deb12u1"}]}],"versions":["3.81-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.83-2~deb13u1"}]}],"versions":["3.83-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.83-2"}]}],"versions":["3.83-1","3.83-2~deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.830.0-3.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.810.0-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.81-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.81-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.73-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.78-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.830.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.830.0-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.71-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.830.0-150000.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.71-1","3.71-1build1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.71-2","3.71-2build1","3.72-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.72-3build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.72-3build2","3.72-3build3","3.72-5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.76-1ubuntu0.1"}]}],"versions":["3.76-1","3.76-1build1","3.76-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.81-1ubuntu0.1"}]}],"versions":["3.81-1","3.81-1build1","3.81-1build2","3.81-1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.83-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.83-1ubuntu0.1"}]}],"versions":["3.83-1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.76-1ubuntu0.1"}]}],"versions":["3.76-1","3.76-1build1","3.76-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.81-1ubuntu0.1"}]}],"versions":["3.81-1","3.81-1build1","3.81-1build2","3.81-1build3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libhtml-parser-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.83-1ubuntu0.1"}]}],"versions":["3.83-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.850.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"perl-HTML-Parser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.830.0-160000.3.1"}]}]}],"products":[{"vendor":"oalders","product":"html::entities"},{"vendor":"oalders","product":"html\\"}],"references":[{"url":"https://github.com/libwww-perl/HTML-Parser/pull/56","tags":["patch","Issue Tracking","Patch","fix","report"]},{"url":"https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch","tags":["patch","Patch","fix"]},{"url":"http://www.openwall.com/lists/oss-security/2026/06/04/2","tags":["Mailing List","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/06/msg00044.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8829","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9p7j-9995-m88w"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-8829","tags":["advisory"]},{"url":"https://cpan.org/modules","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8829.json","tags":["advisory"]},{"url":"https://github.com/libwww-perl/HTML-Parser","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8829","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0264.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35632","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/04/2","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/CNUNI2FWJG22SMHLLF6L6BGYNBH6YI52/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2672","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622189-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1267606","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-8829","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262948-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262950-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8829","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8829","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8587-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-8829","title":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T02:03:46.702Z","modified":"2026-06-28T11:34:26.121Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:48:02.226896Z"}],"euvd":[{"id":"EUVD-2026-34194","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T02:03:46Z","modified":"2026-06-28T11:34:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:20:23.349194Z"}],"ghsa":[{"id":"GHSA-9p7j-9995-m88w","title":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS...","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T03:30:22Z","modified":"2026-06-28T12:30:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:09:02.633671Z"}],"nvd":[{"id":"CVE-2026-8829","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T03:16:20.26Z","modified":"2026-07-22T20:10:00.127Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"BELL-CVE-2026-8829","status":"published","published":"2026-06-06T06:12:17.969848Z","modified":"2026-06-09T07:15:10.323676753Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:26.630331Z"},{"id":"CVE-2026-8829","title":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T02:03:46.702Z","modified":"2026-10-28T11:19:22.01582832Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:19.210277Z"},{"id":"DEBIAN-CVE-2026-8829","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.  The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.  The read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T03:16:20.26Z","modified":"2026-10-01T03:03:53.887350064Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:46:05.506112Z"},{"id":"OESA-2026-2672","title":"perl-HTML-Parser security update","description":"Objects of the HTML::Parser class will recognize markup and separate it from plain text (alias data content) in HTML documents. As different kinds of markup and text are recognized, the corresponding event handlers are invoked.\r\n\r\nSecurity Fix(es):\n\nHTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV\u0026apos;s PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.(CVE-2026-8829)","status":"published","published":"2026-06-12T11:11:36Z","modified":"2026-08-18T01:20:04.627767955Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"UBUNTU-CVE-2026-8829","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation. The read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T03:16:00Z","modified":"2026-07-22T20:46:45.831159008Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"AZL-89451","title":"CVE-2026-8829 affecting package perl-HTML-Parser for versions less than 3.82-2","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.\n\nThe XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.\n\nThe read may disclose adjacent heap contents into the destination SV.","status":"published","published":"2026-06-04T03:16:20Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.436971Z"},{"id":"MGASA-2026-0264","title":"Updated perl-HTML-Parser packages fix security vulnerability","description":"HTML::Entities versions before 3.84 for Perl read freed heap memory in\n_decode_entities. (CVE-2026-8829)\n","status":"published","published":"2026-07-18T22:21:31Z","modified":"2026-07-18T22:30:04.779494492Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:10957-1","title":"perl-HTML-Parser-3.850.0-1.1 on GA media","description":"These are all security issues fixed in the perl-HTML-Parser-3.850.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-04T00:00:00Z","modified":"2026-06-05T10:45:55.491227407Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21126-1","title":"Security update for perl-HTML-Parser","description":"This update for perl-HTML-Parser fixes the following issue\n\n- CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in _decode_entities (bsc#1267606).\n","status":"published","published":"2026-06-20T06:49:38Z","modified":"2026-06-30T18:24:43.754769398Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22189-1","title":"Security update for perl-HTML-Parser","description":"This update for perl-HTML-Parser fixes the following issue\n\n- CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in _decode_entities (bsc#1267606).\n","status":"published","published":"2026-06-20T06:49:45Z","modified":"2026-06-24T09:00:06.643460848Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2948-1","title":"Security update for perl-HTML-Parser","description":"This update for perl-HTML-Parser fixes the following issue\n\n- CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in _decode_entities (bsc#1267606).\n","status":"published","published":"2026-07-14T09:23:13Z","modified":"2026-07-15T10:00:06.157934361Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2950-1","title":"Security update for perl-HTML-Parser","description":"This update for perl-HTML-Parser fixes the following issue\n\n- CVE-2026-8829: HTML:Entities versions before 3.84 for Perl read freed heap memory in _decode_entities (bsc#1267606).\n","status":"published","published":"2026-07-14T09:24:33Z","modified":"2026-07-15T10:00:14.512936386Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8587-1","title":"libhtml-parser-perl vulnerability","description":"It was discovered that HTML-Parser incorrectly handled entity references\nwhen the input string was identical to an entity value in the lookup table.\nAn attacker could possibly use this issue to obtain sensitive information.","status":"published","published":"2026-07-22T13:18:12Z","modified":"2026-07-22T20:59:40.084128299Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}