What’s Vulnerable › Vulnerabilities

CVE-2026-8829: HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-04 · updated 2026-07-22
• Weakness: CWE-416

Description

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation. The read may disclose adjacent heap contents into the destination SV.

Affected products

• OALDERS Html::Entities: before 3.84 — fixed in 3.84

How to fix

Upgrade to a fixed version: OALDERS Html::Entities 3.84. Check the vendor advisory for mitigations.

References

• https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch
• https://github.com/libwww-perl/HTML-Parser/pull/56
• http://www.openwall.com/lists/oss-security/2026/06/04/2
• https://lists.debian.org/debian-lts-announce/2026/06/msg00044.html

Get alerted when CVE-2026-8829 or the next vulnerability affects your stack