CVE-2025-15646

Name	CVE-2025-15646
Description	HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1104789

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libhtml-gumbo-perl (PTS)	bullseye	0.18-2	vulnerable
	bookworm	0.18-3+deb12u1	fixed
	trixie	0.18-5	fixed
	forky, sid	0.20-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libhtml-gumbo-perl	source	bookworm	0.18-3+deb12u1
libhtml-gumbo-perl	source	(unstable)	0.18-5			1104789

Notes

[bullseye] - libhtml-gumbo-perl <postponed> (Minor issue)
https://lists.security.metacpan.org/cve-announce/msg/41446255/
https://github.com/ruz/HTML-Gumbo/issues/6
https://github.com/bestpractical/html-gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186 (0.19)