CVE-2026-8177XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences.
Updated under an hour ago ()
Does this affect you?
It lists no affected products yet. Add what you run and Signals checks it as products are added.
No exploitation reported and no EPSS estimate yet.
XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.
- CVSS
- 7.5 HIGH (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-125
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Not given
- NVD analysis
- Deferred
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
No affected products are listed yet.
References
- https://github.com/cpan-authors/XML-LibXML/commit/15652bd905a6c9dda59a81b14d4766adbbae2ea8.patch
- https://github.com/cpan-authors/XML-LibXML/issues/146
- https://github.com/cpan-authors/XML-LibXML/pull/149
- http://www.openwall.com/lists/oss-security/2026/05/10/8
- http://www.openwall.com/lists/oss-security/2026/05/11/2
- https://access.redhat.com/errata/RHSA-2026:39547
- https://access.redhat.com/errata/RHSA-2026:39553
- https://access.redhat.com/errata/RHSA-2026:39878
- https://access.redhat.com/errata/RHSA-2026:68632
- https://access.redhat.com/errata/RHSA-2026:68685
- https://access.redhat.com/errata/RHSA-2026:68688
- https://access.redhat.com/errata/RHSA-2026:68693
- https://access.redhat.com/security/cve/CVE-2026-8177
- https://bugzilla.redhat.com/show_bug.cgi?id=2468684
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8177.json
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.