HTML::Gumbo before version 0.19 mishandles the <template> element during DOM traversal. The walk_tree function treats a <template> node as an ordinary text node and applies strlen() to a pointer that actually refers to an unsupported out‑of‑bounds read. The over‑read bytes are serialized back into the output when parse() is called with format='string' or format='tree', exposing a bounded portion of heap memory. This manifests as data leakage rather than code execution.

BPS:HTML::Gumbo for Perl, all releases earlier than 0.19 are vulnerable. No other listed vendors or products are affected.

With a CVSS score of 9.8 the vulnerability is classified as critical. The EPSS score of less than 1% indicates a very low but non‑zero exploitation likelihood, and it is not listed in CISA’s KEV catalog. The likely attack vector involves parsing user‑supplied HTML that contains a <template> element using the 'string' or 'tree' format; the over‑read bytes are then serialized into the output, disclosing bounded heap memory. Based on the description, it is inferred that the attacker must be able to supply such input to the application.