CVE-2006-10003: 
Rocky Linux vulnerability analysis and mitigation

CVE-2006-10003 is an off-by-one heap buffer overflow vulnerability in the st_serial_stack function of XML::Parser for Perl, affecting all versions through 2.47. The flaw was originally reported and a patch provided on 2006-06-13, migrated to GitHub in 2019, and formally assigned a CVE and publicly disclosed on March 19, 2026 by the CPAN Security Group (Openwall OSS-Sec). Affected software includes XML::Parser versions ≤ 2.47 (CPE: cpe:2.3:a:toddr:xml::parser:*:*:*:*:*:perl:*:*), with downstream impact on IBM Guardium Data Protection and Microsoft Azure Linux 3 packages (Red Hat Advisory, IBM Advisory). It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory).

The root cause is a classic off-by-one error (CWE-193) leading to a heap-based buffer overflow (CWE-122) in Expat/Expat.xs. In the startElement handler, the stack growth check if (cbv->st_serial_stackptr >= cbv->st_serial_stacksize) fails to trigger reallocation when stackptr == stacksize - 1; the subsequent pre-increment cbv->st_serial_stack[++cbv->st_serial_stackptr] then writes one element past the end of the allocated heap buffer (GitHub Issue #39, Openwall OSS-Sec). The vulnerability is triggered by parsing an XML document with sufficiently deep element nesting (observable with Valgrind at ~512+ levels), and is exploitable over the network without authentication or user interaction. The fix changes the condition to stackptr + 1 >= stacksize to ensure reallocation occurs before the write (GitHub Patch).

Successful exploitation can result in arbitrary code execution with full impact to confidentiality, integrity, and availability of the affected system, as reflected in the CVSS score of 9.8 Critical. Any application or service that uses XML::Parser to process XML from untrusted or network-accessible sources is at risk, including web services, email processing pipelines, and data integration tools. Depending on the privilege level of the Perl process, an attacker could achieve full system compromise, potentially enabling lateral movement within the affected environment (Openwall OSS-Sec, Red Hat Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.019% (0.000190), indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Despite the high CVSS score, the practical exploitability may be constrained by the need to trigger precise heap layout conditions for reliable code execution.

1. Reconnaissance: Identify applications or services that use XML::Parser for Perl versions ≤ 2.47 to process XML input, particularly those accepting XML from network sources (e.g., web APIs, SOAP services, XML-based file upload endpoints).
2. Craft malicious XML: Generate an XML document with deeply nested elements exceeding approximately 512 levels (the initial stack size), sufficient to trigger the off-by-one condition in st_serial_stack. Example structure: <a><b><c>...(600+ levels)...</c></b></a>.
3. Deliver the payload: Submit the crafted XML to the target application via the relevant input channel (HTTP POST, file upload, API call, etc.).
4. Trigger the overflow: When XML::Parser's startElement handler processes the deeply nested elements, the flawed stack growth check fails to reallocate, causing a write one element past the heap buffer boundary.
5. Achieve code execution: Depending on heap layout and memory allocator behavior, the out-of-bounds write may corrupt adjacent heap metadata or function pointers, potentially enabling arbitrary code execution in the context of the Perl process (GitHub Issue #39, Openwall OSS-Sec).

• Network: Unusually large or deeply structured XML payloads submitted to services known to use XML::Parser; repeated XML parsing requests with abnormal nesting depth from a single source IP.
• Process: Unexpected crashes or segmentation faults in Perl processes that handle XML parsing; Perl processes spawning unexpected child processes (e.g., shells, network utilities).
• Logs: Application error logs showing memory corruption errors, segfaults, or abnormal termination during XML parsing operations; Valgrind-style heap error messages if diagnostic tools are enabled.
• File System: Unexpected files written by the Perl service account, such as web shells or scripts, following XML parsing activity.

The primary remediation is to upgrade XML::Parser to version 2.48 or later, which includes the one-line fix changing the stack growth check from stackptr >= stacksize to stackptr + 1 >= stacksize (GitHub Patch). Red Hat has issued multiple errata addressing this issue across RHEL 7–10 (RHSA-2026:7679, 7680, 7681, 8577, 8578, 8608, 8609, 8610, 9110, 9246, 9258, 9259, 9605) (Red Hat Bugzilla). Ubuntu (USN-8174-1), Debian (DSA-6182-1, DLA-4522-1), Amazon Linux 2/2023, openSUSE, and AlmaLinux have also released updated packages. As a workaround where patching is not immediately possible, restrict or sanitize XML input to limit element nesting depth before passing it to XML::Parser, particularly for inputs from untrusted sources (Openwall OSS-Sec).

The CPAN Security Group (CPANSec) coordinated the formal CVE assignment and public disclosure via the oss-security mailing list in March 2026, noting that a patch had been publicly available since June 2006 but was never applied to a released version (Openwall OSS-Sec). The disclosure prompted rapid patching activity across major Linux distributions including Red Hat, Debian, Ubuntu, openSUSE, Amazon Linux, Rocky Linux, AlmaLinux, and Oracle Linux. Community discussion noted the unusual situation of a nearly 20-year-old bug with a known patch finally receiving a CVE identifier and coordinated remediation.