TI-2006-06994 Aliases CVE-2006-10003 GHSA-x2wr-f89p-cqwh

Heap-based buffer overflow in TODDR XML::Parser

MEDIUM 50CWE-122Published 2026-03-19 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 17 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-122 and the CVSS impact.

Summary

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0057 47th percentileScored 2026-11-07

Fix Partial Red Hat: 13 advisoriesRed Hat: 17 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TODDR	XML::Parser	up to 2.47	—	No fix listed	CNA

XML::Parser VendorTODDR Affected up to 2.47 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:toddr:xml\:\:parser::::::perl::*	parser	Vulnerable	TODDR

cpe:2.3:a:toddr:xml\:\:parser:*:*:*:*:*:perl:*:* Versions parser Vulnerable ·TODDR

Remediation

Red Hat 13 advisories

RHSA-2026:9605 Released 2026-04-22 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream EUS (v.9.6) perl-XML-Parser-2.46-9.el9_6.1
RHSA-2026:9259 Released 2026-04-21 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream EUS (v.9.4) perl-XML-Parser-2.46-9.el9_4.1
RHSA-2026:9258 Released 2026-04-21 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream E4S (v.9.2) perl-XML-Parser-2.46-9.el9_2.1

Show 10 more Red Hat advisories

RHSA-2026:9246 Released 2026-04-21 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream E4S (v.9.0) perl-XML-Parser-2.46-9.el9_0.1
RHSA-2026:9110 Released 2026-04-20 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream EUS (v. 10.0) perl-XML-Parser-2.47-6.el10_0.1
RHSA-2026:8610 Released 2026-04-16 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream AUS (v.8.6) perl-XML-Parser-2.44-11.el8_6.1
- Red Hat Enterprise Linux AppStream E4S (v.8.6) perl-XML-Parser-2.44-11.el8_6.1
- Red Hat Enterprise Linux AppStream TUS (v.8.6) perl-XML-Parser-2.44-11.el8_6.1
RHSA-2026:8608 Released 2026-04-16 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) perl-XML-Parser-2.44-11.el8_4.1
- Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) perl-XML-Parser-2.44-11.el8_4.1
RHSA-2026:8609 Released 2026-04-16 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) perl-XML-Parser-2.44-11.el8_2.1
RHSA-2026:8578 Released 2026-04-16 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux Server (v. 7 ELS) perl-XML-Parser-2.41-10.el7_9.1
RHSA-2026:8577 Released 2026-04-16 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream E4S (v.8.8) perl-XML-Parser-2.44-11.el8_8.1
- Red Hat Enterprise Linux AppStream TUS (v.8.8) perl-XML-Parser-2.44-11.el8_8.1
RHSA-2026:7679 Released 2026-04-13 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream (v. 9) perl-XML-Parser-2.46-9.1.el9_7
RHSA-2026:7681 Released 2026-04-13 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream (v. 8) perl-XML-Parser-2.44-12.el8_10
RHSA-2026:7680 Released 2026-04-13 · Red Hat rating Important
perl-XML-Parser security update
- Red Hat Enterprise Linux AppStream (v. 10) perl-XML-Parser-2.47-6.1.el10_1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 10)	Fixed	RHSA-2026:7680
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2026:7681
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2026:7679
Red Hat Enterprise Linux AppStream AUS (v. 8.2)	Fixed	RHSA-2026:8609
Red Hat Enterprise Linux AppStream AUS (v.8.4)	Fixed	RHSA-2026:8608
Red Hat Enterprise Linux AppStream AUS (v.8.6)	Fixed	RHSA-2026:8610
Red Hat Enterprise Linux AppStream E4S (v.8.6)	Fixed	RHSA-2026:8610
Red Hat Enterprise Linux AppStream E4S (v.8.8)	Fixed	RHSA-2026:8577
Red Hat Enterprise Linux AppStream E4S (v.9.0)	Fixed	RHSA-2026:9246
Red Hat Enterprise Linux AppStream E4S (v.9.2)	Fixed	RHSA-2026:9258
Red Hat Enterprise Linux AppStream EUS (v. 10.0)	Fixed	RHSA-2026:9110
Red Hat Enterprise Linux AppStream EUS (v.9.4)	Fixed	RHSA-2026:9259
Red Hat Enterprise Linux AppStream EUS (v.9.6)	Fixed	RHSA-2026:9605
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)	Fixed	RHSA-2026:8608
Red Hat Enterprise Linux AppStream TUS (v.8.6)	Fixed	RHSA-2026:8610
Red Hat Enterprise Linux AppStream TUS (v.8.8)	Fixed	RHSA-2026:8577
Red Hat Enterprise Linux Server (v. 7 ELS)	Fixed	RHSA-2026:8578

Timeline

2026-10-02 Threatist record created from CVE-2006-10003
2026-10-03 Alias added: GHSA-x2wr-f89p-cqwh

References

Patch 2

Other 2

TI-2006-06993 Heap-based buffer overflow in TODDR XML::Parser CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences