https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:08:00 +0000 https://vulnerability.circl.lu/vuln/cve-2026-8829 <p><strong>Affected:</strong> OALDERS HTML::Entities</p> <p>HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.</p> <p>The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV&#39;s PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.</p> <p>The read may disclose adjacent heap contents into the destination SV.</p> <p><strong>Affected:</strong> OALDERS HTML::Entities</p> <p>HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.</p> <p>The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV&#39;s PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation.</p> <p>The read may disclose adjacent heap contents into the destination SV.</p> https://vulnerability.circl.lu/vuln/cve-2026-8829