XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack
Summary
| CVE | CVE-2006-10003 |
|---|---|
| State | PUBLISHED |
| Assigner | CPANSec |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-03-19 12:16:17 UTC |
| Updated | 2026-06-30 03:16:38 UTC |
| Description | XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting |
Risk And Classification
Primary CVSS: v3.1 9.8 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.005480000 probability, percentile 0.418230000 (date 2026-07-02)
Problem Types: CWE-122 | CWE-193 | CWE-193 CWE-193 Off-by-one Error | CWE-122 CWE-122 Heap-based Buffer Overflow | CWE-193 Off-by-one Error
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | DECLARED | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | ADP | CVSS | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 8.8 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:9258 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8578 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2006-10003 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:7679 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:7681 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| security.access.redhat.com/data/csaf/v2/vex/2006/cve-2006-10003.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/errata/RHSA-2026:9110 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8608 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:9605 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| rt.cpan.org/Ticket/Display.html | 9b29abf9-4ab0-4765-b253-1875cd9b441e | rt.cpan.org | Mailing List |
| github.com/cpan-authors/XML-Parser/issues/39 | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | Issue Tracking |
| github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962... | 9b29abf9-4ab0-4765-b253-1875cd9b441e | github.com | Patch |
| access.redhat.com/errata/RHSA-2026:9246 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| www.openwall.com/lists/oss-security/2026/03/19/2 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | Mailing List, Patch, Third Party Advisory |
| access.redhat.com/errata/RHSA-2026:8609 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:7680 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:8610 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:9259 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| lists.debian.org/debian-lts-announce/2026/04/msg00002.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| access.redhat.com/errata/RHSA-2026:8577 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2006-06-13T00:00:00.000Z | Issue logged and patch provided in Request Tracker for XML::Parser |
| CNA | 2019-09-23T00:00:00.000Z | Issue migrated to github issue tracker |
| CNA | 2019-09-24T00:00:00.000Z | Patch provided in github issue tracker |
| CNA | 2026-03-16T00:00:00.000Z | PR created and commit merged to git repo |
| ADP | 2026-03-19T12:01:39.997Z | Reported to Red Hat. |
| ADP | 2026-03-19T11:08:04.341Z | Made public. |
Solutions
CNA: Apply the patch that has been publicly available since 2006-06-13 or upgrade to version 2.48 or later when it is released.
ADP: RHSA-2026:8578: Red Hat Enterprise Linux Server (v. 7 ELS)
ADP: RHSA-2026:9110: Red Hat Enterprise Linux AppStream EUS (v. 10.0)
ADP: RHSA-2026:7680: Red Hat Enterprise Linux AppStream (v. 10)
ADP: RHSA-2026:7681: Red Hat Enterprise Linux AppStream (v. 8)
ADP: RHSA-2026:8609: Red Hat Enterprise Linux AppStream AUS (v. 8.2)
ADP: RHSA-2026:8608: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)
ADP: RHSA-2026:8610: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)
ADP: RHSA-2026:8577: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)
ADP: RHSA-2026:9246: Red Hat Enterprise Linux AppStream E4S (v.9.0)
ADP: RHSA-2026:9258: Red Hat Enterprise Linux AppStream E4S (v.9.2)
ADP: RHSA-2026:9259: Red Hat Enterprise Linux AppStream EUS (v.9.4)
ADP: RHSA-2026:9605: Red Hat Enterprise Linux AppStream EUS (v.9.6)
ADP: RHSA-2026:7679: Red Hat Enterprise Linux AppStream (v. 9)
Workarounds
CNA: Apply the patch that has been publicly available since 2006-06-13.
ADP: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.