Is CVE-2006-10003 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2006-10003 being exploited in the wild.

How severe is CVE-2006-10003?

Critical severity, with a CVSS score of 9.8, published 19 March 2026.

Which products and versions are affected?

CPAN XML::Parser through 2.47; Debian Libxml-Parser-Perl 2.46-2+deb11u1.

Is there a fix for CVE-2006-10003?

A patch was published on 2026-03-16: Fix merged into the official GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2006-10003 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2006-10003?

Check whether you run CPAN XML::Parser, Debian Libxml-Parser-Perl or Toddr Xml\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2006-10003: CPAN XML::Parser heap buffer overflow in st_serial_stack

CVE-2006-10003 · Severity: critical · CVSS 9.8 · Published 2026-03-19

XML::Parser is a widely used Perl library for processing XML data. A flaw in how it handles deeply nested XML elements can lead to memory corruption. An attacker could exploit this by providing a specially crafted XML file, potentially allowing them to crash the application or execute unauthorized code on the system.

Vendors: CPAN, Debian.

Quick answers

Is CVE-2006-10003 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2006-10003 being exploited in the wild.
How severe is CVE-2006-10003?: Critical severity, with a CVSS score of 9.8, published 19 March 2026.
Which products and versions are affected?: CPAN XML::Parser through 2.47; Debian Libxml-Parser-Perl 2.46-2+deb11u1.
Is there a fix for CVE-2006-10003?: A patch was published on 2026-03-16: Fix merged into the official GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2006-10003 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2006-10003?: Check whether you run CPAN XML::Parser, Debian Libxml-Parser-Perl or Toddr Xml\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An off-by-one heap buffer overflow exists in XML::Parser's Expat.xs component within the st_serial_stack growth logic. The vulnerability occurs because the check (stackptr >= stacksize) fails to account for the subsequent pre-increment operation (++stackptr), resulting in a write one element past the allocated buffer when the stack is nearly full. This can be triggered by parsing XML files with extreme element nesting depths (e.g., 500+ levels). Attackers can leverage this for memory corruption, potentially leading to arbitrary code execution or a denial of service. The issue has been addressed in version 2.48 and various vendor backports (e.g., Debian DLA 4522-1, RHSA-2026:7679).

Affected products

CPAN XML::Parser through 2.47
Red Hat Enterprise Linux 7, 8, 9, 10
Debian libxml-parser-perl 2.46-2+deb11u1

Timeline

2006-06-13: disclosed: Issue originally reported in CPAN Request Tracker #19860
2026-03-16: patched: Fix merged into the official GitHub repository
2026-03-19: advisory: CVE-2006-10003 published and CPAN Security Group advisory issued
2026-04-04: patched: Debian released security update DLA-4522-1
2026-04-13: patched: Red Hat released security advisory RHSA-2026:7679

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.