CVE-2025-15646: HTML::Gumbo Information Disclosure Flaw

CVE-2025-15646 Overview

CVE-2025-15646 is a heap memory disclosure vulnerability in the HTML::Gumbo Perl module before version 0.19. The flaw stems from type confusion in the walk_tree function within lib/HTML/Gumbo.xs, which fails to handle the <template> element added to libgumbo 0.10.0 in 2015. The parser treats template nodes as text nodes, causing strlen() to over-read the heap block referenced by the pointer. The over-read bytes are then serialized into the returned parse result, leaking bounded heap contents to the caller.

Critical Impact
Any application invoking parse() with the default format => 'string' or with format => 'tree' on attacker-controlled HTML containing a <template> element discloses adjacent heap memory.

Affected Products

HTML::Gumbo for Perl versions before 0.19
Applications and services embedding HTML::Gumbo for HTML parsing
Debian packages shipping vulnerable HTML::Gumbo releases (see Debian Bug #1104789)

Discovery Timeline

2026-07-01 - CVE-2025-15646 published to the National Vulnerability Database (NVD)
2026-07-01 - OpenWall oss-security discussion published
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2025-15646

Vulnerability Analysis

The vulnerability is a type confusion issue [CWE-125] in the Perl XS bindings for the Gumbo HTML5 parser. Support for the HTML <template> element was introduced in libgumbo 0.10.0, but the walk_tree function in lib/HTML/Gumbo.xs was never updated to recognize the new GUMBO_NODE_TEMPLATE node type. When the parser encounters a <template> element, control flow falls through to the text-node handling path.

The text-node path invokes strlen() on a pointer that does not reference a null-terminated string. The read continues past the end of the allocated heap object until an unrelated null byte is encountered. The resulting byte range is copied into the serialized parse output, exposing adjacent heap memory to any caller that receives the return value.

Root Cause

The root cause is an incomplete update to walk_tree following the addition of the GUMBO_NODE_TEMPLATE enumeration in libgumbo. The dispatch predicate accepted only GUMBO_NODE_DOCUMENT and GUMBO_NODE_ELEMENT, so template nodes were misrouted to a code path that assumes a text node structure. This produces a classic out-of-bounds read via strlen().

Attack Vector

An attacker supplies HTML input containing a <template> element to any application that parses untrusted markup with HTML::Gumbo. When the application uses format => 'string' or format => 'tree', leaked heap bytes are embedded in the returned data. Applications using format => 'callback' are unaffected because that path reaches a croak on the unhandled node type.

text

 STATIC
 void
 walk_tree(pTHX_ GumboNode* node, int flags, void (*cb)(pTHX_ PerlHtmlGumboType, GumboNode*, void*), void* ctx ) {
-    if ( node->type == GUMBO_NODE_DOCUMENT || node->type == GUMBO_NODE_ELEMENT ) {
+    if ( node->type == GUMBO_NODE_DOCUMENT || node->type == GUMBO_NODE_ELEMENT || node->type == GUMBO_NODE_TEMPLATE) {
         GumboVector* children;
         int skip = flags&PHG_FLAG_SKIP_ROOT_ELEMENT && node->type == GUMBO_NODE_ELEMENT && node->parent && node->parent->type == GUMBO_NODE_DOCUMENT;
         if ( !skip ) {

Source: GitHub Patch Commit

Detection Methods for CVE-2025-15646

Indicators of Compromise

HTTP request or file inputs containing <template> elements delivered to services that parse HTML with HTML::Gumbo
Application responses containing unexpected binary bytes, pointer-like strings, or fragments of unrelated request data adjacent to parsed HTML output
Installed Perl module inventory showing HTML::Gumbo at any version below 0.19

Detection Strategies

Inventory Perl module versions across servers and container images by querying cpanm --info HTML::Gumbo or inspecting MYMETA.json and package manifests
Inspect application logs and outbound responses for high-entropy or non-UTF-8 byte sequences co-located with parsed HTML content
Add unit tests that parse HTML containing <template> and verify serialized output matches the input, flagging trailing garbage as a regression

Monitoring Recommendations

Alert on inbound HTML payloads containing <template> tags routed to endpoints known to use HTML::Gumbo
Monitor deployed CPAN dependency graphs for HTML::Gumbo < 0.19 and integrate the check into CI pipelines
Track upstream Debian bug #1104789 and the bestpractical/HTML-Gumbo repository for follow-up advisories

How to Mitigate CVE-2025-15646

Immediate Actions Required

Upgrade HTML::Gumbo to version 0.19 or later on all systems that parse untrusted HTML
Rebuild and redeploy container images and Perl application bundles that vendor HTML::Gumbo
Audit application code for parse() calls with format => 'string' or format => 'tree' operating on untrusted input

Patch Information

The fix landed in HTML::Gumbo0.19 via commit 15c0598909d4a64f47ef0a1abc5051f4e113c186, which adds GUMBO_NODE_TEMPLATE to the accepted node types in walk_tree. Refer to the MetaCPAN Release Changes and the GitHub Patch Commit for details. Additional distribution context is available in the Debian Bug Report #1104789 and the OpenWall OSS Security Discussion.

Workarounds

Switch calls to format => 'callback', which reaches a croak on the unhandled node type and does not disclose memory
Strip or reject <template> elements from untrusted HTML before parsing with a pre-filter
Restrict use of HTML::Gumbo to trusted input sources until the package is upgraded

bash

# Upgrade HTML::Gumbo to the fixed release
cpanm HTML::Gumbo@0.19

# Verify the installed version
perl -MHTML::Gumbo -e 'print $HTML::Gumbo::VERSION, "\n"'