CVE-2006-10002: 
Rocky Linux vulnerability analysis and mitigation

CVE-2006-10002 is a heap-based buffer overflow vulnerability in XML::Parser for Perl affecting versions through 2.47. The flaw exists in the parse_stream() function within Expat.xs, where a :utf8 PerlIO layer causes the XML input buffer to overflow because Perl's read() returns decoded characters while SvPV() returns multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size, resulting in heap corruption (double free or corruption) and crashes. The issue was originally reported on 2006-06-13 and formally assigned a CVE by CPANSec on 2026-03-19. It carries a CVSS v3.1 base score of 7.5 (High) (Openwall OSS-Sec, Red Hat CVE).

The root cause is an incorrect calculation of buffer size (CWE-131) combined with improper handling of Unicode encoding (CWE-176), leading to a heap-based buffer overflow (CWE-122). In parse_stream() within Expat.xs, the code pre-allocates an XML input buffer sized for character counts, but when a filehandle has a :utf8 PerlIO layer, Perl's read() returns the number of decoded Unicode characters while SvPV() returns the raw multi-byte UTF-8 byte representation — which can be up to 6x larger per character. This mismatch causes the Copy(tb, buffer, br, char) call at line 388 to write beyond the allocated buffer, corrupting the heap. The fix, merged on 2026-03-16, re-obtains the expat buffer at the actual byte size when the read produces more bytes than initially allocated (GitHub Commit, GitHub Issue #64).

Successful exploitation causes heap corruption (double free or buffer overflow), leading to application crashes and denial of service. Any Perl application that uses XML::Parser to parse XML from a filehandle opened with a :utf8 PerlIO layer is affected, which includes a broad range of XML-processing tools and services. While the primary confirmed impact is availability (crash/DoS), heap corruption of this nature can theoretically be leveraged for arbitrary code execution in some scenarios, though no such exploitation has been demonstrated (Openwall OSS-Sec, Red Hat Bugzilla).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is network-accessible and requires no authentication or user interaction, but exploitation requires that the target application specifically parses XML from a UTF-8 encoded stream (Openwall OSS-Sec, Red Hat CVE).

1. Identify target: Find a network-accessible Perl application that uses XML::Parser (versions ≤ 2.47) to parse XML input from a filehandle opened with a :utf8 PerlIO layer.
2. Craft malicious XML input: Prepare an XML document containing a high density of multi-byte UTF-8 characters (e.g., 3-byte or 4-byte Unicode characters such as CJK ideographs) to maximize the byte-to-character ratio and ensure the UTF-8 byte representation exceeds the pre-allocated buffer size.
3. Submit input: Send the crafted UTF-8 XML payload to the target application via its normal input channel (e.g., HTTP request body, file upload, network socket).
4. Trigger overflow: When the application calls parse_stream() with the :utf8 filehandle, SvPV() returns more bytes than the pre-allocated buffer can hold, causing heap corruption.
5. Achieve DoS: The heap corruption results in a double-free or buffer overflow condition, crashing the Perl interpreter with a glibc error such as *** glibc detected *** double free or corruption (GitHub Issue #64, Openwall OSS-Sec).

• Logs: Application or system logs showing glibc memory corruption errors such as *** glibc detected *** double free or corruption (!prev) originating from a Perl process running XML::Parser.
• Process: Unexpected crashes or core dumps of Perl interpreter processes handling XML input, particularly those processing UTF-8 encoded streams.
• File System: Core dump files (e.g., core.*) in the working directory of the affected Perl application following a crash event.
• Network: Repeated submission of large XML payloads containing high-density multi-byte UTF-8 characters (e.g., CJK characters) to XML-processing endpoints, potentially followed by service unavailability (GitHub Issue #64).

Upgrade XML::Parser to version 2.48 or later, which contains the fix merged on 2026-03-16 that re-obtains the expat buffer at the actual byte size when UTF-8 streams produce more bytes than initially allocated. As a workaround, Perl applications can set input filehandles to :raw or :bytes mode before passing them to XML::Parser, preventing the UTF-8 decoding mismatch. Major Linux distributions have released updated packages: Red Hat Enterprise Linux 7–10 via RHSA-2026:7679, RHSA-2026:7680, RHSA-2026:7681, and subsequent errata; Ubuntu via USN-8174-1; Debian via DLA-4522-1; openSUSE and Amazon Linux 2/AL2023 have also issued updates (Red Hat Bugzilla, Openwall OSS-Sec, GitHub Commit).

The vulnerability was disclosed via the oss-security mailing list by Timothy Legge of the CPAN Security Group on 2026-03-19, noting that the underlying bug had been reported as far back as 2006-06-13 but remained unpatched in the module for nearly 20 years. Salvatore Bonaccorso (Debian) followed up on 2026-03-22 clarifying that an earlier partial fix had been applied in version 2.45, prompting an update to the CVE record (Openwall OSS-Sec, Openwall Follow-up). The disclosure prompted rapid patching activity across major Linux distributions including Red Hat, Debian, Ubuntu, openSUSE, Amazon Linux, Oracle Linux, Rocky Linux, and AlmaLinux.