Back Linuxsecurity

Fedora 44 perl-HTML-Gumbo Critical Information Disclosure 2026

Linuxsecurity •LinuxSecurity Advisories • July 11, 2026

This package provides the Perl module HTML::Gumbo. Versions before 0.19 disclose heap memory via type confusion. Support for the element was added to libgumbo 0.10.0 in 2015, but the walk_tree function in lib/HTML/Gumbo.xs was not updated to support it. The element was treated as a text-node, where strlen() over-reads the heap block that the pointer addresses.

* Sat May 30 2026 Emmanuel Seyman - 0.19-1 - Update to 0.19 - Update dependencies - Use /usr/bin/perl instead of %{__perl}

[ 1 ] Bug #2496536 - CVE-2025-15646 perl-HTML-Gumbo: HTML::Gumbo: Information disclosure through HTML template processing [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-75010c7f44' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Memory Disclosure Vulnerability in Fedora's perl-HTML-Gumbo Module Fedora's perl-HTML-Gumbo module versions prior to 0.19 are vulnerable to a critical information disclosure issue due to type confusion. This flaw allows attackers to disclose heap memory, potentially exposing sensitive data. The vulnerability was identified in the walk_tree function of the module, which misinterprets certain HTML elements as text nodes. The issue affects all Fedora versions using the affected module, with a CVE-2025-15646 published on July 1, 2026. The vulnerability was addressed in an update released on May 30, 2026, by Emmanuel Seyman, who updated the module to version 0.19. Users are advised to upgrade their installations to mitigate the risk. The flaw has been categorized as critical due to its potential impact on user data security. 2 sources 70

Extracted Entities

Fedora 44 perl-HTML-Gumbo Critical Information Disclosure 2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (3)