CVE-2006-10003: Critical Heap Overflow in Perl XML::Parser

CVE-2006-10003 is a critical off-by-one heap buffer overflow (CVSS 9.8) in XML::Parser for Perl, versions through 2.47. The CPAN Security Group says to apply the long-available patch or upgrade to 2.48 or later once released. Distribution packages may carry their own fix, such as Debian 11's 2.46-2+deb11u1.

What's affected

• Product: XML::Parser, the Perl module that wraps the Expat XML parser.
• Versions: through 2.47, per the CPAN Security Group announcement.
• Fixed: the announcement says to apply the patch that has been public since 2006-06-13, or upgrade to 2.48 or later when it is released. I could not confirm a 2.48 release from the pages I read, so check CPAN for the current version.
• Debian 11 (bullseye): fixed in libxml-parser-perl 2.46-2+deb11u1 (DLA-4522-1, 4 April 2026).
• Weaknesses: CWE-122 heap-based buffer overflow and CWE-193 off-by-one error.
• CVSS 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The record also lists a Red Hat erratum, RHSA-2026:7679, which I did not read. Check it if you run Red Hat based systems.

How to check if you're exposed

Many tools pull XML::Parser in indirectly, so look at the system and not only at your own code.

perl -MXML::Parser -e 'print "$XML::Parser::VERSION\n"'
cpan -D XML::Parser
dpkg -l libxml-parser-perl
rpm -q perl-XML-Parser

Version numbers on distribution packages can be misleading because vendors backport fixes without changing the upstream number. Compare the package version against your vendor's security advisory, not only against 2.47.

For application code, search for the module and for the places where it parses data from outside your network.

grep -rln "XML::Parser" /opt /usr/local /var/www 2>/dev/null

Look for anything that feeds untrusted XML to it: upload handlers, feed readers, API endpoints that accept XML and import jobs.

What to do now

1. List every host and container image with XML::Parser or libxml-parser-perl installed.
2. Update through your distribution's security channel where it has published a fix. On Debian 11, install 2.46-2+deb11u1 or later.
3. For modules installed from CPAN, upgrade to 2.48 or later when it is available, or apply the patch referenced in the advisory.
4. Rebuild container images that bundle the module and redeploy them.
5. Until patched, stop feeding XML from untrusted sources to Perl code that uses the module, or limit its size and nesting depth before parsing.
6. Re-scan after the update to confirm the old version is gone.

Why it matters

The bug is in the code that tracks open elements while parsing. The module keeps a stack for them. When the stack is exactly one slot from full, it is not grown, and the next push writes one position past the end of the allocation. The advisory says the problem shows up when parsing an XML file with very deep element nesting.

An off-by-one write on the heap is small, but heap corruption in a parser that reads untrusted input is serious, which is why the score is 9.8 with network access and no privileges. The record gives no exploitation details and the CISA KEV flag is false, so there is no confirmed exploitation to report. The notable fact is the age: the report and patch were logged in 2006 and the fix was merged into the repository in March 2026. Old, quiet dependencies deserve the same inventory as new ones.

Try it yourself

This walkthrough shows how a scan surfaces a weakness like this one and what the finding looks like.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CPAN Security Group announcement on oss-security
• Debian LTS advisory DLA-4522-1
• Gold record for CVE-2006-10003

Last reviewed: 19 October 2026.