CVE-2026-8177 Details

A vulnerability in XML::LibXML versions through 2.0210 for Perl allows for out-of-bounds heap memory reads. This occurs when the parser processes XML node names with truncated UTF-8 byte sequences, leading to potential memory safety issues. The flaw can be exploited by any Perl process that sends attacker-controlled strings to XML::LibXML's DOM node-name methods, using the default API. The vulnerability likely causes a process crash, resulting in a denial-of-service condition.

Users can update to the patched version of XML::LibXML that validates UTF-8 continuation bytes before parsing. The specific commit addressing this vulnerability is available on the XML::LibXML GitHub repository.