CVE-2026-8829: HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities

Synopsis

A use-after-free read vulnerability affects HTML::Entities for Perl in versions before 3.84. The flaw is reachable over the network with no authentication required, triggered when attacker-controlled HTML input causes the XS routine _decode_entities to read from a freed heap buffer. Successful exploitation discloses adjacent heap memory contents to the caller, which may include sensitive in-process data. A patched-image rebuild at version 3.84 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The affected HTML::Entities decode routine is typically invoked on network-supplied input, so an attacker can trigger the flaw by sending crafted HTML over the network to any application that decodes entities from untrusted input.

• AuthenticationNot required

  No authentication is needed; the CVSS vector specifies PR:N, meaning any unauthenticated request carrying malicious entity references is sufficient to trigger the bug.

• Victim interactionNot required

  No victim action is required; the application processes the malicious input autonomously as part of normal HTML entity decoding.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and imposes no special pre-conditions such as race windows or specific memory layout requirements.

Blast Radius

• An attacker reads raw bytes from heap memory adjacent to the freed buffer, which may include cached strings, session tokens, or other in-process data handled by the Perl interpreter.
• Disclosed heap contents can be returned inside the decoded output SV and transmitted back to the attacker in an application response, depending on how the caller uses the return value.
• There is no integrity or availability impact; the vulnerability is confined to unauthorized memory reads.