CVE-2026-8829

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

Published Jun 4, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.

The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.

The read may disclose adjacent heap contents into the destination SV.

Analysis

Technical impact

HTML::Entities versions prior to 3.84 contain a use‑after‑free bug in the _decode_entities routine. The routine caches a pointer into a string that may be freed later, so that a subsequent copy operation reads data from a reclaimed heap region. This flaw can lead to disclosure of adjacent heap contents when copying from the freed buffer, potentially exposing sensitive data. The weakness is a classic use‑after‑free issue as classified by CWE‑416.

Affected Systems

The vulnerability impacts the HTML::Entities Perl module, distributed by OALDERS. All released versions before 3.84 are affected. Systems that load this library, such as Perl applications that parse or render user‑supplied HTML using HTML::Entities, are at risk unless they have upgraded to version 3.84 or later.

Risk and Exploitability

The flaw permits arbitrary read of freed memory. The CVSS score of 7.5 indicates high severity. The EPSS score is 0.00017, indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The exploit requires local execution of code that uses the vulnerable library; an attacker would need to supply crafted entity references that trigger the freed memory copy path. Thus the attack surface is limited to environments where untrusted input can be processed by the module.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

OALDERS

HTML::Entities

unaffected

Version	Status	Constraints
`0`	affected	< 3.84

Configuration 1 [-]

cpe:2.3:a:oalders:html\:\:entities:*:*:*:*:*:perl:*:*

No data.

Vendor Product Versions

Oalders

Html::entities

Version	Status	Scheme	Platform
`[0,3.84)`	affected	generic	—

Remediation

Vendor Solution

Upgrade to HTML-Parser 3.84 or later.

OpenCVE Recommended Actions

Upgrade to HTML-Parser 3.84 or later, which contains the fix for the use‑after‑free issue.
Implement strict input validation to prevent entity references that map an entity key to its own value, thereby blocking the reallocated buffer read path.
If an immediate upgrade is not feasible, limit the usage of HTML::Entities to trusted input sources only, and consider isolating the parsing logic in a sandboxed environment to contain potential memory disclosure.

Generated by OpenCVE AI on June 4, 2026 at 15:25 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4655-1	libhtml-parser-perl security update
Ubuntu USN	USN-8587-1	HTML-Parser vulnerability

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.408% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/06/04/2
https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch
https://github.com/libwww-perl/HTML-Parser/pull/56
https://lists.debian.org/debian-lts-announce/2026/06/msg00044.html

History

Jun 8, 2026 4:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oalders html\
CPEs		cpe:2.3:a:oalders:html\:\:entities::::::perl::*
Vendors & Products		Oalders html\

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Oalders Oalders html::entities
Vendors & Products		Oalders Oalders html::entities

Jun 4, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 4, 2026 7:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/06/04/2

Jun 4, 2026 2:30 AM Description updated. Title updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation. The read may disclose adjacent heap contents into the destination SV.
Title		HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities
Weaknesses		CWE-416
References		https://github.com/libwww-perl/HTML-Parser/commit/6922552b0778c90a9587a3894e248be4d3a25e1c.patch https://github.com/libwww-perl/HTML-Parser/pull/56