CVE-2006-10003
Last modified
CVE-2006-10003 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting. EPSS estimates a 0.55% chance of exploitation in the next 30 days.
Description
XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Toddr | Xml\ | < 2.48 | Parser |
References
- https://github.com/cpan-authors/XML-Parser/issues/39Issue Tracking
- https://rt.cpan.org/Ticket/Display.html?id=19860Mailing List
- https://www.openwall.com/lists/oss-security/2026/03/19/2Mailing List, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-10003?
How severe is CVE-2006-10003?
How do I fix CVE-2006-10003?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-0997The SSL server implementation in NILE.NLM in Novell NetWare …
- CVE-2006-0998The SSL server implementation in NILE.NLM in Novell NetWare …
- CVE-2006-0999The SSL server implementation in NILE.NLM in Novell NetWare …
- CVE-2006-1000Multiple SQL injection vulnerabilities in Pentacle In-Out Bo…
- CVE-2006-10001A vulnerability, which was classified as problematic, was fo…5.4
- CVE-2006-10002XML::Parser versions through 2.45 for Perl could overflow th…7.5
- CVE-2006-1001SQL injection vulnerability in the board module in LanSuite …
- CVE-2006-1002NETGEAR WGT624 Wireless DSL router has a default account of …
- CVE-2006-1003The backup configuration option in NETGEAR WGT624 Wireless F…
- CVE-2006-1004Cross-site scripting (XSS) vulnerability in agencyprofile.as…
- CVE-2006-1005agencyprofile.asp in Parodia 6.2 and earlier might allow rem…
- CVE-2006-1006Multiple SQL injection vulnerabilities in sendcard.php in se…
Are you affected by CVE-2006-10003?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST