---
id: CVE-2025-15646
title: >-
  HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type
  confusion.


  Support for the <template> element was added to libgumbo 0.10.0 in 2015, but
  the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it
summary: >-
  HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type
  confusion.


  Support for the <template> element was added to libgumbo 0.10.0 in 2015, but
  the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. T…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
  - CWE-843
published: '2026-07-01'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T21:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-15646'
references:
  - url: 'https://bugs.debian.org/1104789'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: >-
      https://github.com/bestpractical/HTML-Gumbo/commit/15c0598909d4a64f47ef0a1abc5051f4e113c186.patch
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'https://metacpan.org/release/BPS/HTML-Gumbo-0.19/changes'
    label: 9b29abf9-4ab0-4765-b253-1875cd9b441e
  - url: 'http://www.openwall.com/lists/oss-security/2026/07/01/7'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00671
epssPercentile: 0.50162
ingestedAt: '2026-09-30T21:25:07.791Z'
---

## Overview

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion.

Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.

Any caller that runs parse() with the default format => 'string', or with format => 'tree', on input containing a <template> element serializes the over-read bytes into the returned result, disclosing bounded heap contents. format => 'callback' reaches a croak on the unhandled node type and is unaffected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.