Your message dated Sat, 04 Jul 2026 14:43:21 +0000
with message-id <[email protected]>
and subject line Bug#1104789: fixed in libhtml-gumbo-perl 0.18-3+deb12u1
has caused the Debian Bug report #1104789,
regarding libhtml-gumbo-perl: erratic behavior on the unsupported template HTML
element - GUMBO_NODE_TEMPLATE node type (CVE-2025-15646)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1104789: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104789
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: libhtml-gumbo-perl
Version: 0.18-4+b1
Severity: serious
Tags: security upstream
Justification: security
Forwarded: https://github.com/ruz/HTML-Gumbo/issues/6
X-Debbugs-Cc: Debian Security Team <[email protected]>
I get erratic behavior on the template HTML element, e.g. on
the HTML file "<template>". For instance:
$ perl -C -MHTML::Gumbo -e "print HTML::Gumbo->new->parse('<template>', format
=> 'string');"
<html><head>\217¥�¾U</head><body></body></html>
$ perl -C -MHTML::Gumbo -e "print HTML::Gumbo->new->parse('<template>', format
=> 'string');"
<html><head>)�>\220U</head><body></body></html>
$ perl -C -MHTML::Gumbo -e "print HTML::Gumbo->new->parse('<template>', format
=> 'string');"
<html><head>q'N$uU</head><body></body></html>
One can see random output, which may include control characters
(above, I have changed them to \217 and \220 as Emacs shows them,
to avoid such control characters in the mail message).
With valgrind:
$ valgrind perl -C -MHTML::Gumbo -e "print
HTML::Gumbo->new->parse('<template>', format => 'string');"
==64955== Memcheck, a memory error detector
==64955== Copyright (C) 2002-2024, and GNU GPL'd, by Julian Seward et al.
==64955== Using Valgrind-3.24.0 and LibVEX; rerun with -h for copyright info
==64955== Command: perl -C -MHTML::Gumbo -e print\
HTML::Gumbo-\>new-\>parse('\<template\>',\ format\ =\>\ 'string');
==64955==
==64955== Conditional jump or move depends on uninitialised value(s)
==64955== at 0x484DC89: strlen (vg_replace_strmem.c:505)
==64955== by 0x2AD7DF: ??? (in /usr/bin/perl)
==64955== by 0x486D6CE: tree_to_string (Gumbo.xs:189)
==64955== by 0x486E2C4: walk_tree.isra.0 (Gumbo.xs:55)
==64955== by 0x486E2C4: walk_tree.isra.0 (Gumbo.xs:55)
==64955== by 0x486E2C4: walk_tree.isra.0 (Gumbo.xs:55)
==64955== by 0x486E41B: parse_to_string_cb (Gumbo.xs:505)
==64955== by 0x486ED4B: common_parse.isra.0 (Gumbo.xs:545)
==64955== by 0x486F09C: XS_HTML__Gumbo_parse_to_string (Gumbo.xs:559)
==64955== by 0x20B3E7: ??? (in /usr/bin/perl)
==64955== by 0x290C95: Perl_runops_standard (in /usr/bin/perl)
==64955== by 0x179E51: perl_run (in /usr/bin/perl)
==64955==
<html><head></head><body></body></html>
==64955==
==64955== HEAP SUMMARY:
==64955== in use at exit: 592,160 bytes in 2,369 blocks
==64955== total heap usage: 7,166 allocs, 4,797 frees, 1,159,576 bytes
allocated
==64955==
==64955== LEAK SUMMARY:
==64955== definitely lost: 18,102 bytes in 19 blocks
==64955== indirectly lost: 50,698 bytes in 23 blocks
==64955== possibly lost: 514,100 bytes in 2,318 blocks
==64955== still reachable: 9,260 bytes in 9 blocks
==64955== of which reachable via heuristic:
==64955== newarray : 1,056 bytes in 33 blocks
==64955== suppressed: 0 bytes in 0 blocks
==64955== Rerun with --leak-check=full to see details of leaked memory
==64955==
==64955== Use --track-origins=yes to see where uninitialised values come from
==64955== For lists of detected and suppressed errors, rerun with: -s
==64955== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
So, uninitialized data are used for the output.
If I use "format => 'callback'" (will a callback) instead of
"format => 'string'", then I get the following error:
Unknown node type at /usr/lib/x86_64-linux-gnu/perl5/5.40/HTML/Gumbo.pm line
298, <> line 1.
(which is better from the security point of view, but prevents one
from parsing some modern HTML documents).
It apparently comes from Gumbo.xs, where there are two occurrences of
croak("Unknown node type");
I suspect that this is the first one as the second one corresponds to
text node types.
The cause is probably the most recent node type GUMBO_NODE_TEMPLATE
from the Gumbo library (libgumbo):
typedef enum {
/** Document node. v will be a GumboDocument. */
GUMBO_NODE_DOCUMENT,
/** Element node. v will be a GumboElement. */
GUMBO_NODE_ELEMENT,
/** Text node. v will be a GumboText. */
GUMBO_NODE_TEXT,
/** CDATA node. v will be a GumboText. */
GUMBO_NODE_CDATA,
/** Comment node. v will be a GumboText, excluding comment delimiters. */
GUMBO_NODE_COMMENT,
/** Text node, where all contents is whitespace. v will be a GumboText. */
GUMBO_NODE_WHITESPACE,
/** Template node. This is separate from GUMBO_NODE_ELEMENT because many
* client libraries will want to ignore the contents of template nodes, as
* the spec suggests. Recursing on GUMBO_NODE_ELEMENT will do the right thing
* here, while clients that want to include template contents should also
* check for GUMBO_NODE_TEMPLATE. v will be a GumboElement. */
GUMBO_NODE_TEMPLATE
} GumboNodeType;
This node type was added in 2015:
https://github.com/google/gumbo-parser/commit/4383a40605ee7872a8e2de58553383a13d919153
but most of the HTML::Gumbo code predates this change.
-- System Information:
Debian Release: trixie/sid
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500,
'stable-security'), (500, 'stable-debug'), (500, 'proposed-updates-debug'),
(500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 6.11.10-amd64 (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE,
TAINT_UNSIGNED_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages libhtml-gumbo-perl depends on:
ii libc6 2.41-7
ii libgumbo3 0.13.0+dfsg-2
ii libhtml-tree-perl 5.07-3
ii perl 5.40.1-3
ii perl-base [perlapi-5.40.0] 5.40.1-3
libhtml-gumbo-perl recommends no packages.
libhtml-gumbo-perl suggests no packages.
-- no debconf information
--
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
--- End Message ---
--- Begin Message ---
Source: libhtml-gumbo-perl
Source-Version: 0.18-3+deb12u1
Done: Andrew Ruthven <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libhtml-gumbo-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andrew Ruthven <[email protected]> (supplier of updated libhtml-gumbo-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 28 Jun 2026 15:19:13 +1200
Source: libhtml-gumbo-perl
Architecture: source
Version: 0.18-3+deb12u1
Distribution: bookworm
Urgency: medium
Maintainer: Andrew Ruthven <[email protected]>
Changed-By: Andrew Ruthven <[email protected]>
Closes: 1104789
Changes:
libhtml-gumbo-perl (0.18-3+deb12u1) bookworm; urgency=medium
.
* Team upload.
* [CVE-2025-15646] Add patch to fix wrong code path with GUMBO_NODE_TEMPLATE.
Thanks to Vincent Lefevre for the bug report and Niko Tyni for the patch.
(Closes: #1104789)
Checksums-Sha1:
ff655f7241072d558f0894423794475d6e967032 2228
libhtml-gumbo-perl_0.18-3+deb12u1.dsc
1b536dfc7f8a15a48c722c1333e99762e5d0e5ab 4072
libhtml-gumbo-perl_0.18-3+deb12u1.debian.tar.xz
b264b3a7b8d2fc7b41d90177f22563af9e030d56 6983
libhtml-gumbo-perl_0.18-3+deb12u1_amd64.buildinfo
Checksums-Sha256:
ea6f4164d5f4e39285510791df3078a8663294a73855b8c4004c7e23c6146120 2228
libhtml-gumbo-perl_0.18-3+deb12u1.dsc
11a2e4f16f62d52654358917a409c31145380f55729ca54c7a396589dfcb09bd 4072
libhtml-gumbo-perl_0.18-3+deb12u1.debian.tar.xz
ea5d27de06bc12243d4e3186195227bca9af2c73dc8caa7f7781c8314e132d94 6983
libhtml-gumbo-perl_0.18-3+deb12u1_amd64.buildinfo
Files:
651c4052cdbf3d52ff31089fd3a3f682 2228 perl optional
libhtml-gumbo-perl_0.18-3+deb12u1.dsc
93256754ee2b5de5f0bdd57f170288d0 4072 perl optional
libhtml-gumbo-perl_0.18-3+deb12u1.debian.tar.xz
e0a29a30b99fcf2ae3253ab56a004771 6983 perl optional
libhtml-gumbo-perl_0.18-3+deb12u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEExgP8TmAPHOzRyNl8S1PZMeTT6GMFAmpDrCwACgkQS1PZMeTT
6GPjKQ/+JOJnyyltCWAshMikfkRAuKAtMS8LNSy1+DDLz5Xn/H5JhJOyBp4oxfae
i3ei7j+hSEwBL7IZLP0dKKpfuOHvebRKPExd7lD5lPxrSTKj33r55xODXCA+hx2g
zc3963VT4unxE1AxUqSCrONfSbVz/jKQfQpdAV8UdQHR6x0BL6EZ1sY7RdxFlBpJ
58KdHcwnDGAORWno8ntxcfWovIhm8dMLRkL9087NGHiVCGOB9C+EF6+oa771oCLN
nAL26LV24mwsITKi3/quGfk2MHZJVLPisknh1fn9OYK9NylkWV2trMp5A3CAG6yq
IPEENaZSLKNh3NikCYjwhRYujakX3hjhU4dAi3hPKXHapvc5+IDZbPTeg851+U+b
IMvxAK3rZOJgWzwCYU2UghJKq+xXFTvwkHwh8WbbCCiU9JU5jVT5IFwicqSorZGt
C1X9EEu7TcKNItmggW8GvcH+7F4pJzTP/Z7kPuXQAQr4F3GlYESK4UZ/0xNoDf/d
Kx61HVBQtYFthoroYeVakI/yvDe1E86WubHSkvUw7dJugPTBbplDT7OY1lMxviU3
G5uNb0bmrJc3QfIaFY6GfACj2GSrZxCTMkqdagzSZAmP8tJoBPHPBSRuE9NMwSAE
WeRxnf1tqMKUl1nv+eLx98/mnyWqIU69VPcvJQEefIrQH5BkneE=
=ZSag
-----END PGP SIGNATURE-----
pgpgKWd9ZsdIe.pgp
Description: PGP signature
--- End Message ---
