USN-8587-1: HTML-Parser vulnerability

unknownCVE-2026-8829

It was discovered that HTML-Parser incorrectly handled entity references when the input string was identical to an entity value in the lookup table. An attacker could possibly use this issue to obtain sensitive information.

CSIRTS triage

product: HTML-Parser Information disclosure

What: HTML-Parser incorrectly handled entity references, potentially allowing sensitive information to be obtained.
Who is affected: Users of HTML-Parser that process input strings identical to entity values.
Urgency: Remediation is necessary due to the potential for information disclosure.
Action: Update to the latest version of HTML-Parser.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch HTML-Parser

Get an email when a new HTML-Parser advisory drops — max one per day, one-click unsubscribe.

Details

Source: Ubuntu Security Notices (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-07-22
Exploitation: Not in CISA KEV at last sync

Original advisory: https://ubuntu.com/security/notices/USN-8587-1

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-88290.41% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 34% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-8829	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

highCVE-2026-8829: HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entitiesmsrc