# CVE-2006-10003: CPAN XML::Parser heap buffer overflow in st_serial_stack

Source: https://junglewise.ai/threats/cve-2006-10003-cpan-xml-parser-heap-buffer-overflow-in-st-serial-stack  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-19. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2006-10003 · Severity: critical · CVSS 9.8 · Published 2026-03-19

XML::Parser is a widely used Perl library for processing XML data. A flaw in how it handles deeply nested XML elements can lead to memory corruption. An attacker could exploit this by providing a specially crafted XML file, potentially allowing them to crash the application or execute unauthorized code on the system.

Vendors: [CPAN](https://junglewise.ai/threats/vendors/cpan), [Debian](https://junglewise.ai/threats/vendors/debian).

## Quick answers

**Is CVE-2006-10003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2006-10003 being exploited in the wild.

**How severe is CVE-2006-10003?** Critical severity, with a CVSS score of 9.8, published 19 March 2026.

**Which products and versions are affected?** CPAN XML::Parser through 2.47; Debian Libxml-Parser-Perl 2.46-2+deb11u1.

**Is there a fix for CVE-2006-10003?** A patch was published on 2026-03-16: Fix merged into the official GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2006-10003 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2006-10003?** Check whether you run CPAN XML::Parser, Debian Libxml-Parser-Perl or Toddr Xml\ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An off-by-one heap buffer overflow exists in XML::Parser's Expat.xs component within the st_serial_stack growth logic. The vulnerability occurs because the check (stackptr >= stacksize) fails to account for the subsequent pre-increment operation (++stackptr), resulting in a write one element past the allocated buffer when the stack is nearly full. This can be triggered by parsing XML files with extreme element nesting depths (e.g., 500+ levels). Attackers can leverage this for memory corruption, potentially leading to arbitrary code execution or a denial of service. The issue has been addressed in version 2.48 and various vendor backports (e.g., Debian DLA 4522-1, RHSA-2026:7679).

## Affected products

- CPAN XML::Parser through 2.47
- Red Hat Enterprise Linux 7, 8, 9, 10
- Debian libxml-parser-perl 2.46-2+deb11u1

## Timeline

- 2006-06-13: disclosed: Issue originally reported in CPAN Request Tracker #19860
- 2026-03-16: patched: Fix merged into the official GitHub repository
- 2026-03-19: advisory: CVE-2006-10003 published and CPAN Security Group advisory issued
- 2026-04-04: patched: Debian released security update DLA-4522-1
- 2026-04-13: patched: Red Hat released security advisory RHSA-2026:7679

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch](https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch)
- [https://github.com/cpan-authors/XML-Parser/issues/39](https://github.com/cpan-authors/XML-Parser/issues/39)
- [https://rt.cpan.org/Ticket/Display.html?id=19860](https://rt.cpan.org/Ticket/Display.html?id=19860)
- [http://www.openwall.com/lists/oss-security/2026/03/19/2](http://www.openwall.com/lists/oss-security/2026/03/19/2)
- [https://lists.debian.org/debian-lts-announce/2026/04/msg00002.html](https://lists.debian.org/debian-lts-announce/2026/04/msg00002.html)
- [https://access.redhat.com/errata/RHSA-2026:7679](https://access.redhat.com/errata/RHSA-2026:7679)