What’s Vulnerable › Vulnerabilities

CVE-2025-6498: HTACG tidy-html5 alloc.c defaultAlloc memory leak

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-06-23 · updated 2026-06-17
• Weakness: CWE-401

Description

A vulnerability classified as problematic has been found in HTACG tidy-html5 5.8.0. Affected is the function defaultAlloc of the file src/alloc.c. The manipulation leads to memory leak. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Affected products

• HTACG tidy-html5: 5.8.0

References

• https://github.com/htacg/tidy-html5/issues/1152
• https://github.com/user-attachments/files/20438303/tidy-html5_crash_3.txt
• https://vuldb.com/?ctiid.313614
• https://vuldb.com/?id.313614
• https://vuldb.com/?submit.601009
• https://github.com/htacg/tidy-html5/issues/1152

Get alerted when CVE-2025-6498 or the next vulnerability affects your stack