CVE-2006-10002
XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes
CVSS Score
9.8
EPSS Score
0.1%
EPSS Percentile
18th
XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.
| CWE | CWE-122 CWE-176 |
| Vendor | toddr |
| Product | xml::parser |
| Published | Mar 19, 2026 |
| Last Updated | Mar 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for toddr xml::parser
Be the first to know when new critical vulnerabilities affecting toddr xml::parser are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TODDR / XML::Parser
0 ≤ 2.45
References
rt.cpan.org: https://rt.cpan.org/Ticket/Display.html?id=19859 github.com: https://github.com/cpan-authors/XML-Parser/issues/64 metacpan.org: https://metacpan.org/release/TODDR/XML-Parser-2.46/changes github.com: https://github.com/cpan-authors/XML-Parser/commit/56b0509dfc6b559cd7555ea81ee62e3622069255.patch openwall.com: http://www.openwall.com/lists/oss-security/2026/03/19/1 openwall.com: http://www.openwall.com/lists/oss-security/2026/03/22/3