High severity7.5NVD Advisory· Published May 10, 2026· Updated Jul 24, 2026
CVE-2026-8177
CVE-2026-8177
Description
XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences.
A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory.
Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
20- Range: <=2.0210
- osv-coords18 versionspkg:rpm/almalinux/perl-XML-LibXMLpkg:rpm/opensuse/perl-XML-LibXML&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/perl-XML-LibXML&distro=openSUSE%20Tumbleweedpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSSpkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%2016.0pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6pkg:rpm/suse/perl-XML-LibXML&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0
< 1:2.0210-4.el10_2.1+ 17 more
- (no CPE)range: < 1:2.0210-4.el10_2.1
- (no CPE)range: < 2.0210-160000.3.1
- (no CPE)range: < 2.0212-1.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0019-6.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0210-160000.3.1
- (no CPE)range: < 2.0019-6.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0132-150000.3.8.1
- (no CPE)range: < 2.0210-160000.3.1
Patches
Vulnerability mechanics
References
11- www.openwall.com/lists/oss-security/2026/05/10/8nvd
- www.openwall.com/lists/oss-security/2026/05/11/2nvd
- access.redhat.com/errata/RHSA-2026:39547nvd
- access.redhat.com/errata/RHSA-2026:39553nvd
- access.redhat.com/errata/RHSA-2026:39878nvd
- access.redhat.com/security/cve/CVE-2026-8177nvd
- bugzilla.redhat.com/show_bug.cginvd
- github.com/cpan-authors/XML-LibXML/commit/15652bd905a6c9dda59a81b14d4766adbbae2ea8.patchnvd
- github.com/cpan-authors/XML-LibXML/issues/146nvd
- github.com/cpan-authors/XML-LibXML/pull/149nvd
- security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8177.jsonnvd
News mentions
0No linked articles in our index yet.