Description
The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libhtml-parser-perl | 3.64-1 | — |
| Debian 13 | libhtml-parser-perl | 3.64-1 | — |
| Debian 12 | libhtml-parser-perl | 3.64-1 | — |
| Debian 5.0 | libhtml-parser-perl | 3.56-1+lenny1 | DSA-1923-1 |
| Debian 4.0 | libhtml-parser-perl | 3.55-1+etch1 | DSA-1923-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-HTML-Parser | 3.72-1.7 | openSUSE-SU-2024:10369-1 |
Advisories 2
- DSA-1923-1 libhtml-parser-perl - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10369-1 perl-HTML-Parser-3.72-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- ADV-2009-3022 vdb-entry
- [oss-security] 20091023 CVE-2009-3627 assignment notification - HTML-Parser-3.63 mailing-list
- htmlparser-decodeentities-dos(53941) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=530604
- 36807 vdb-entry
- 37155 third-party-advisory
- https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6225
- http://github.com/gisle/html-parser/commit/b9aae1e43eb2c8e989510187cff0ba3e996f9a4c