{"id":"CVE-2006-10003","state":"PUBLISHED","title":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack","description":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting","publishedAt":"2026-03-19T11:08:04.341Z","updatedAt":"2026-07-15T01:28:08.168Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"CPANSec","products":["TODDR XML::Parser"],"affected":[{"vendor":"TODDR","product":"XML::Parser","packageName":"XML-Parser","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.47","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["Expat.xs"],"programRoutines":[{"name":"startElement"}],"repo":"http://github.com/toddr/XML-Parser"}],"references":["https://rt.cpan.org/Ticket/Display.html?id=19860","https://github.com/cpan-authors/XML-Parser/issues/39","https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch","http://www.openwall.com/lists/oss-security/2026/03/19/2","https://lists.debian.org/debian-lts-announce/2026/04/msg00002.html","https://access.redhat.com/security/cve/CVE-2006-10003","https://bugzilla.redhat.com/show_bug.cgi?id=2448999","https://security.access.redhat.com/data/csaf/v2/vex/2006/cve-2006-10003.json","https://access.redhat.com/errata/RHSA-2026:8578","https://access.redhat.com/errata/RHSA-2026:9110","https://access.redhat.com/errata/RHSA-2026:7680","https://access.redhat.com/errata/RHSA-2026:7681","https://access.redhat.com/errata/RHSA-2026:8609","https://access.redhat.com/errata/RHSA-2026:8608","https://access.redhat.com/errata/RHSA-2026:8610","https://access.redhat.com/errata/RHSA-2026:8577","https://access.redhat.com/errata/RHSA-2026:9246","https://access.redhat.com/errata/RHSA-2026:9258","https://access.redhat.com/errata/RHSA-2026:9259","https://access.redhat.com/errata/RHSA-2026:9605","https://access.redhat.com/errata/RHSA-2026:7679"],"weaknesses":["CWE-193","CWE-122"],"ingestedAt":"2026-10-29T19:27:35.992Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2006/10xxx/CVE-2006-10003.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2006-10003","state":"PUBLISHED","datePublished":"2026-03-19T11:08:04.341Z","dateUpdated":"2026-07-15T01:28:08.168Z","assignerShortName":"CPANSec","assignerOrgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateReserved":"2026-03-16T22:52:39.890Z"},"containers":{"cna":{"title":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack","descriptions":[{"lang":"en","value":"XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting"}],"affected":[{"vendor":"TODDR","product":"XML::Parser","packageName":"XML-Parser","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.47","versionType":"custom"}],"collectionURL":"https://cpan.org/modules","programFiles":["Expat.xs"],"programRoutines":[{"name":"startElement"}],"repo":"http://github.com/toddr/XML-Parser"}],"references":[{"url":"https://rt.cpan.org/Ticket/Display.html?id=19860","tags":["issue-tracking"]},{"url":"https://github.com/cpan-authors/XML-Parser/issues/39","tags":["issue-tracking"]},{"url":"https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch","tags":["patch"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-193","description":"CWE-193 Off-by-one Error","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-122","description":"CWE-122 Heap-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CPANSec","orgId":"9b29abf9-4ab0-4765-b253-1875cd9b441e","dateUpdated":"2026-03-19T11:08:04.341Z"},"solutions":[{"lang":"en","value":"Apply the patch that has been publicly available since 2006-06-13 or upgrade to version 2.48 or later when it is released."}],"source":{"discovery":"UNKNOWN"},"timeline":[{"lang":"en","time":"2006-06-13T00:00:00.000Z","value":"Issue logged and patch provided in Request Tracker for XML::Parser"},{"lang":"en","time":"2019-09-23T00:00:00.000Z","value":"Issue migrated to github issue tracker"},{"lang":"en","time":"2019-09-24T00:00:00.000Z","value":"Patch provided in github issue tracker"},{"lang":"en","time":"2026-03-16T00:00:00.000Z","value":"PR created and commit merged to git repo"}],"workarounds":[{"lang":"en","value":"Apply the patch that has been publicly available since 2006-06-13."}],"x_generator":{"engine":"cpansec-cna-tool 0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-03-19T17:08:41.621885Z","id":"CVE-2006-10003","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-19T17:09:59.672Z"}},{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/03/19/2"},{"url":"https://lists.debian.org/debian-lts-announce/2026/04/msg00002.html"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-04-04T08:11:42.558Z"}},{"title":"perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files","descriptions":[{"lang":"en","value":"A flaw was found in XML::Parser, a Perl module for parsing XML. This vulnerability, an off-by-one heap buffer overflow, occurs when processing an XML file with very deep element nesting. A remote attacker could exploit this by providing a specially crafted XML file, potentially leading to memory corruption."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.47-6.1.el10_1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.47-6.el10_0.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7 Extended Lifecycle Support","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.41-10.el7_9.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:rhel_els:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-12.el8_10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.2 Advanced Update Support","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.4"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus_long_life:8.4"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_aus:8.6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Telecommunications Update Service","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_tus:8.8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.44-11.el8_8.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:8.8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.46-9.1.el9_7","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.46-9.el9_0.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.46-9.el9_2.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_e4s:9.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.4 Extended Update Support","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.46-9.el9_4.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.4"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9.6 Extended Update Support","packageName":"perl-XML-Parser","defaultStatus":"affected","versions":[{"version":"0:2.46-9.el9_6.1","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:rhel_eus:9.6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"perl-XML-Parser","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2006-10003","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2448999","name":"RHBZ#2448999","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2006/cve-2006-10003.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8578","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9110","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7680","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7681","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8609","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8608","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8610","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8577","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9246","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9258","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9259","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9605","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7679","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-193","description":"Off-by-one Error","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T01:28:08.168Z"},"datePublic":"2026-03-19T11:08:04.341Z","solutions":[{"lang":"en","value":"RHSA-2026:8578: Red Hat Enterprise Linux Server (v. 7 ELS)"},{"lang":"en","value":"RHSA-2026:9110: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"},{"lang":"en","value":"RHSA-2026:7680: Red Hat Enterprise Linux AppStream (v. 10)"},{"lang":"en","value":"RHSA-2026:7681: Red Hat Enterprise Linux AppStream (v. 8)"},{"lang":"en","value":"RHSA-2026:8609: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"},{"lang":"en","value":"RHSA-2026:8608: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"},{"lang":"en","value":"RHSA-2026:8610: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"},{"lang":"en","value":"RHSA-2026:8577: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"},{"lang":"en","value":"RHSA-2026:9246: Red Hat Enterprise Linux AppStream E4S (v.9.0)"},{"lang":"en","value":"RHSA-2026:9258: Red Hat Enterprise Linux AppStream E4S (v.9.2)"},{"lang":"en","value":"RHSA-2026:9259: Red Hat Enterprise Linux AppStream EUS (v.9.4)"},{"lang":"en","value":"RHSA-2026:9605: Red Hat Enterprise Linux AppStream EUS (v.9.6)"},{"lang":"en","value":"RHSA-2026:7679: Red Hat Enterprise Linux AppStream (v. 9)"}],"timeline":[{"lang":"en","time":"2026-03-19T12:01:39.997Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-03-19T11:08:04.341Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}