Skip to content
OpenAdvisories
High USN-8587-1 1 CVE

libhtml-parser-perl vulnerability

Published Jul 22, 2026 · Updated Jul 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that HTML-Parser incorrectly handled entity references
when the input string was identical to an entity value in the lookup table.
An attacker could possibly use this issue to obtain sensitive information.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS libhtml-parser-perl 3.76-1ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS libhtml-parser-perl 3.81-1ubuntu0.1
Ubuntu · 26.04 LTS 26.04:LTS libhtml-parser-perl 3.83-1ubuntu0.1

Vulnerabilities 1

  • High 7.5
    CVE-2026-8829

    HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

    HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV w…

    OALDERS HTML::Entities libhtml-parser-perl perl-HTML-Parser Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-8829