CVE-2026-8177

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and resulting in a denial of service.

A flaw was found in perl-XML-LibXML. The XML::LibXML module reads out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi-byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker-controlled strings to XML::LibXML's DOM node-name methods can trigger this flaw, with the likely consequence being a crash causing denial of service. The vulnerability is in the perl-XML-LibXML package specifically, not in the core perl interpreter. In containerised or pod-based deployments, the availability impact may be reduced since crashed processes are typically auto-restarted by the container orchestrator.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.