CVE-2025-15646

Descripción

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses. Any caller that runs parse() with the default format => -string-, or with format => -tree-, on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => -callback- reaches a croak on the unhandled node type and is unaffected.