CVE-2006-10003

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch	Patch
https://github.com/cpan-authors/XML-Parser/issues/39	Issue Tracking
https://rt.cpan.org/Ticket/Display.html?id=19860	Mailing List
http://www.openwall.com/lists/oss-security/2026/03/19/2	Mailing List Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:toddr:xml\:\:parser:*:*:*:*:*:perl:*:*

History

No history.

Information

Published : 2026-03-19 12:16

Updated : 2026-03-19 18:41

NVD link : CVE-2006-10003

Mitre link : CVE-2006-10003

CVE.ORG link : CVE-2006-10003

JSON object : View

Products Affected

toddr

xml\

CWE

CWE-122

Heap-based Buffer Overflow

CWE-193

Off-by-one Error

{"id": "CVE-2006-10003", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2026-03-19T12:16:17.047", "references": [{"url": "https://github.com/cpan-authors/XML-Parser/commit/3eb9cc95420fa0c3f76947c4708962546bf27cfd.patch", "tags": ["Patch"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://github.com/cpan-authors/XML-Parser/issues/39", "tags": ["Issue Tracking"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://rt.cpan.org/Ticket/Display.html?id=19860", "tags": ["Mailing List"], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/03/19/2", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-122"}, {"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.\n\nIn the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.\n\nThe bug can be observed when parsing an XML file with very deep element nesting"}, {"lang": "es", "value": "Las versiones de XML::Parser hasta la 2.47 para Perl tienen un desbordamiento de b\u00fafer de mont\u00f3n por un error de uno en st_serial_stack.\n\nEn el caso (stackptr == stacksize - 1), la pila NO se expandir\u00e1. Luego, el nuevo valor se escribir\u00e1 en la ubicaci\u00f3n (++stackptr), que es igual a stacksize y, por lo tanto, cae justo fuera del b\u00fafer asignado.\n\nEl error se puede observar al analizar un archivo XML con anidamiento de elementos muy profundo."}], "lastModified": "2026-03-19T18:41:18.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:toddr:xml\\:\\:parser:*:*:*:*:*:perl:*:*", "vulnerable": true, "matchCriteriaId": "11A15992-D3C4-4604-88DF-DF2E7872FEFD", "versionEndExcluding": "2.48"}], "operator": "OR"}]}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}