CVE-2026-7040 Details
Description
Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters. The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption. Note that the minify_utf8 function is an alias for minify.
A heap overflow vulnerability has been identified in the Text::Minify::XS Perl module, specifically in versions 0.3.0 prior to 0.7.8. The issue arises in the minify functions, which improperly handle certain malformed UTF-8 characters, leading to heap corruption. This vulnerability is particularly notable because the minify_utf8 function is an alias for the minify function, potentially increasing the attack surface.
Users can upgrade to Text::Minify::XS version 0.7.8 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/robrwo/Text-Minify-XS/security/advisories/GHSA-jqhf-vv4h-77h2 | CPANSec | Third Party Advisory |
| https://metacpan.org/release/RRWO/Text-Minify-XS-v0.7.8/changes | CPANSec | ProductRelease Notes |
| http://www.openwall.com/lists/oss-security/2026/04/27/5 | CVE | Mailing ListThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | CPANSec |
| CWE-176 | Improper Handling of Unicode Encoding | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| rrwo text::minify::xs | >= 0.3.0, < 0.7.8 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 7, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | CVE Modified | CPANSec |
| Apr 28, 2026 | CVE Modified | CPANSec |
| Apr 27, 2026 | CVE Modified | CVE |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | New CVE Received | CPANSec |