# CVE-2026-8829: HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

CVE-2026-8829 is fixed in 5 products on 1 platform, first by libhtml-parser-perl 3.76-1ubuntu0.1, released June 3, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-8829
- Priority: High
- CVSS: 7.5 (Important)
- EPSS: 0.0041
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 3, 2026
- Weakness: Use After Free
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8829

## Description

HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities. The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV returned by hv_fetch on the entity2char hash. When the input SV was identical to a value SV in that hash, and that value contained its own key as an entity reference, a later call to grow_gap() reallocated the SV's PV buffer and freed the backing allocation that repl still pointed into. The subsequent copy loop read repl_len bytes from the freed allocation. The read may disclose adjacent heap contents into the destination SV.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libhtml-parser-perl Debian 12.15 (bookworm) | 3.81-1+deb12u1 | [DEBIAN-CVE-2026-8829](https://patchblox.com/security/data/fix/linux/debian-cve-2026-8829.md) | Jun 24, 2026 |
| Linux | libhtml-parser-perl Debian 13.5 (trixie) | 3.83-2~deb13u1 | [DEBIAN-CVE-2026-8829](https://patchblox.com/security/data/fix/linux/debian-cve-2026-8829.md) | Jun 24, 2026 |
| Linux | libhtml-parser-perl Debian 14 | 3.83-2 | [DEBIAN-CVE-2026-8829](https://patchblox.com/security/data/fix/linux/debian-cve-2026-8829.md) | Jun 24, 2026 |
| Linux | libhtml-parser-perl Ubuntu 22.04.1 LTS (jammy) | 3.76-1ubuntu0.1 | [libhtml-parser-perl 3.76-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libhtml-parser-perl-3.76-1ubuntu0.1.md) | Jun 3, 2026 |
| Linux | libhtml-parser-perl Ubuntu 24.04.5 LTS (noble) | 3.81-1ubuntu0.1 | [libhtml-parser-perl 3.81-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libhtml-parser-perl-3.81-1ubuntu0.1.md) | Jun 3, 2026 |
| Linux | libhtml-parser-perl Ubuntu 26.04.1 LTS (resolute) | 3.83-1ubuntu0.1 | [libhtml-parser-perl 3.83-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libhtml-parser-perl-3.83-1ubuntu0.1.md) | Jun 3, 2026 |
| Linux | perl-HTML-Parser amzn 2023 | 3.76-1.amzn2023.0.4 | [ALAS2023-2026-1836](https://patchblox.com/security/data/fix/linux/alas2023-2026-1836.md) | Jun 22, 2026 |
| Linux | perl-HTML-Parser opensuse-leap 16.0 | 3.830.0-160000.3.1 | [OPENSUSE-SU-2026:21126-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21126-1.md) | Jun 20, 2026 |
| Linux | perl-HTML-Parser sles 15.7 | 3.830.0-150000.3.6.1 | [SUSE-SU-2026:2950-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-2950-1.md) | Jul 14, 2026 |
| Linux | perl-HTML-Parser sles 16.0 | 3.830.0-160000.3.1 | [SUSE-SU-2026:22189-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-22189-1.md) | Jun 20, 2026 |
| Linux | perl-HTML-Parser-debuginfo amzn 2023 | 3.76-1.amzn2023.0.4 | [ALAS2023-2026-1836](https://patchblox.com/security/data/fix/linux/alas2023-2026-1836.md) | Jun 22, 2026 |
| Linux | perl-HTML-Parser-debugsource amzn 2023 | 3.76-1.amzn2023.0.4 | [ALAS2023-2026-1836](https://patchblox.com/security/data/fix/linux/alas2023-2026-1836.md) | Jun 22, 2026 |
| Linux | perl-HTML-Parser-tests amzn 2023 | 3.76-1.amzn2023.0.4 | [ALAS2023-2026-1836](https://patchblox.com/security/data/fix/linux/alas2023-2026-1836.md) | Jun 22, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.