A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| TODDR | XML::Parser | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
Apply the patch that has been publicly available since 2006-06-13 or upgrade to version 2.48 or later when it is released.
Workaround
Apply the patch that has been publicly available since 2006-06-13.
Thu, 19 Mar 2026 11:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes. | |
| Title | XML::Parser versions through 2.47 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes | |
| Weaknesses | CWE-122 CWE-176 |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: CPANSec
Published:
Updated: 2026-03-19T11:03:46.888Z
Reserved: 2026-03-16T22:47:45.685Z
Link: CVE-2006-10002
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-03-19T12:16:16.120
Modified: 2026-03-19T13:25:00.570
Link: CVE-2006-10002
Redhat
No data.
OpenCVE Enrichment
No data.