Junglewise Threat Intelligence

CVE-2006-10003: CPAN XML::Parser heap buffer overflow in st_serial_stack

CVE-2006-10003 · Severity: critical · CVSS 9.8 · Published 2026-03-19

Technologies: Red Hat Enterprise Linux. Vendors: Debian, Red Hat, CPAN.

Executive brief

XML::Parser is a widely used Perl library for processing XML data. A flaw in how it handles deeply nested XML elements can lead to memory corruption. An attacker could exploit this by providing a specially crafted XML file, potentially allowing them to crash the application or execute unauthorized code on the system.

Technical details

An off-by-one heap buffer overflow exists in XML::Parser's Expat.xs component within the st_serial_stack growth logic. The vulnerability occurs because the check (stackptr >= stacksize) fails to account for the subsequent pre-increment operation (++stackptr), resulting in a write one element past the allocated buffer when the stack is nearly full. This can be triggered by parsing XML files with extreme element nesting depths (e.g., 500+ levels). Attackers can leverage this for memory corruption, potentially leading to arbitrary code execution or a denial of service. The issue has been addressed in version 2.48 and various vendor backports (e.g., Debian DLA 4522-1, RHSA-2026:7679).

Affected products

  • CPAN XML::Parser through 2.47
  • Red Hat Enterprise Linux 7, 8, 9, 10
  • Debian libxml-parser-perl 2.46-2+deb11u1

Timeline

  • 2006-06-13: disclosed: Issue originally reported in CPAN Request Tracker #19860
  • 2026-03-16: patched: Fix merged into the official GitHub repository
  • 2026-03-19: advisory: CVE-2006-10003 published and CPAN Security Group advisory issued
  • 2026-04-04: patched: Debian released security update DLA-4522-1
  • 2026-04-13: patched: Red Hat released security advisory RHSA-2026:7679

References