/ 
XML-LibXML-2.0210
/ t/48_gh_pr63_detect_undef_values.t
Security Advisories (1)
CVE-2026-8177 (2026-05-10)

XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

DESCRIPTION

https://github.com/shlomif/perl-XML-LibXML/pull/63

This test program

use warnings;
use XML::LibXML;

my $test = XML::LibXML::Text->new({}->{bar});

produces the following warning:

$ perl ~/test.pl
Use of uninitialized value in subroutine entry at /home/sven/test.pl line 4.

This apparently happens, because Sv2C tries to catch undef values by comparing the memory location of the scalar in question to &PL_sv_undef. While PL_sv_undef certainly is an undef value, not all undef values share its memory location. The added commit fixes this, by using SvOK to correctly detect all undef values.