CVE-2025-6498: 
Linux Debian vulnerability analysis and mitigation

A vulnerability classified as problematic was discovered in HTACG tidy-html5 version 5.8.0, identified as CVE-2025-6498. The issue affects the defaultAlloc function in the src/alloc.c file, leading to memory leaks. The vulnerability was disclosed on June 22, 2025, and is exploitable through local access (VulDB, NVD).

The vulnerability is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-404 (Improper Resource Shutdown or Release). It has received a CVSS v3.1 Base Score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, and a CVSS v4.0 score of 4.8 (MEDIUM) with the vector string CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P (Wiz).

The vulnerability results in memory leaks where the product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory. This primarily impacts system availability through resource exhaustion (VulDB).

Currently, there are no known official fixes or mitigation strategies available. The recommended approach is to consider replacing the affected product with an alternative solution (Wiz).