What is CVE-2025-15646?

CVE-2025-15646 is a critical-severity vulnerability in Bps Html::gumbo, classified under Out-of-bounds Read. CVSS score: 9.8/10. Published 2026-07-01.

How severe is CVE-2025-15646?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Out-of-bounds Read in Bps Html::gumbo

CVE-2025-15646

HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The…

Vulnerability class: Buffer Overflow

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Bps Html::gumbo — versions 0

Weakness classification (CWE)

References

9b29abf9-4ab0-4765-b253-1875cd9b441e (patch)
9b29abf9-4ab0-4765-b253-1875cd9b441e (release-notes)
9b29abf9-4ab0-4765-b253-1875cd9b441e (issue-tracking)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2025-15646?: CVE-2025-15646 is a critical-severity vulnerability in Bps Html::gumbo, classified under Out-of-bounds Read. CVSS score: 9.8/10. Published 2026-07-01.
How severe is CVE-2025-15646?: Critical severity. CVSS v3 base score is 9.8 out of 10.