XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0767 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2026-8177:
    XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names     containing truncated UTF-8 byte sequences.

    A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of     the input string into adjacent heap memory.

    Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach     this path on the default API. The likely consequence is a crash, causing denial of service.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39547 advisory.

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39547 advisory.

    - Fix out-of-bounds heap read on truncated UTF-8 sequences       (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1285:01 advisory.

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39878 advisory.

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:39553 advisory.

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39878 advisory.

    - Fix out-of-bounds heap read via truncated UTF-8 in node name       validation (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39878 advisory.

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39547 advisory.

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:39553 advisory.

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39553 advisory.

    - Fix out-of-bounds UTF-8 heap read in node name validation       (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39878 advisory.

    This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing     and manipulating XML files. This module allows Perl programmers to make use of the highly capable     validating XML parser and the high performance DOM implementation.

    Security Fix(es):

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39547 advisory.

    This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing     and manipulating XML files. This module allows Perl programmers to make use of the highly capable     validating XML parser and the high performance DOM implementation.

    Security Fix(es):

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:39553 advisory.

    This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing     and manipulating XML files. This module allows Perl programmers to make use of the highly capable     validating XML parser and the high performance DOM implementation.

    Security Fix(es):

    * perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:2402-1 advisory.

    This update for perl-XML-LibXML fixes the following issue

    - CVE-2026-8177: read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8     byte sequences       (bsc#1264715).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2324-1 advisory.

    This update for perl-XML-LibXML fixes the following issue

    - CVE-2026-8177: read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8     byte sequences       (bsc#1264715).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20908-1 advisory.

    This update for perl-XML-LibXML fixes the following issue

    - CVE-2026-8177: read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8     byte sequences       (bsc#1264715).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1795 advisory.

    XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names     containing truncated UTF-8 byte sequences.

    A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of     the input string into adjacent heap memory.

    Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach     this path on the default API. The likely consequence is a crash, causing denial of service.
    (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl-XML-LibXML installed on the remote host is prior to 2.0018-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3342 advisory.

    XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names     containing truncated UTF-8 byte sequences.

    A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of     the input string into adjacent heap memory.

    Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach     this path on the default API. The likely consequence is a crash, causing denial of service.
    (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names     containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence     causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process     that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the     default API. The likely consequence is a crash, causing denial of service. (CVE-2026-8177)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
330259	TencentOS Server 3: perl-XML-LibXML (TSSA-2026:0767)	Nessus	Tencent Local Security Checks	high
328796	AlmaLinux 10 : perl-XML-LibXML (ALSA-2026:39547)	Nessus	Alma Linux Local Security Checks	high
328744	Oracle Linux 10 : perl-XML-LibXML (ELSA-2026-39547)	Nessus	Oracle Linux Local Security Checks	high
327798	MiracleLinux 8 : perl-XML-LibXML-2.0132-3.el8_10 (AXSA:2026-1285:01)	Nessus	Miracle Linux Local Security Checks	high
327432	AlmaLinux 8 : perl-XML-LibXML (ALSA-2026:39878)	Nessus	Alma Linux Local Security Checks	high
327429	AlmaLinux 9 : perl-XML-LibXML (ALSA-2026:39553)	Nessus	Alma Linux Local Security Checks	high
327347	Oracle Linux 8 : perl-XML-LibXML (ELSA-2026-39878)	Nessus	Oracle Linux Local Security Checks	high
327251	RockyLinux 8 : perl-XML-LibXML (RLSA-2026:39878)	Nessus	Rocky Linux Local Security Checks	high
327195	RockyLinux 10 : perl-XML-LibXML (RLSA-2026:39547)	Nessus	Rocky Linux Local Security Checks	high
327194	RockyLinux 9 : perl-XML-LibXML (RLSA-2026:39553)	Nessus	Rocky Linux Local Security Checks	high
327117	Oracle Linux 9 : perl-XML-LibXML (ELSA-2026-39553)	Nessus	Oracle Linux Local Security Checks	high
327032	RHEL 8 : perl-XML-LibXML (RHSA-2026:39878)	Nessus	Red Hat Local Security Checks	high
326954	RHEL 10 : perl-XML-LibXML (RHSA-2026:39547)	Nessus	Red Hat Local Security Checks	high
326921	RHEL 9 : perl-XML-LibXML (RHSA-2026:39553)	Nessus	Red Hat Local Security Checks	high
321583	SUSE SLES12 Security Update : perl-XML-LibXML (SUSE-SU-2026:2402-1)	Nessus	SuSE Local Security Checks	high
321016	SUSE SLED15 / SLES15 Security Update : perl-XML-LibXML (SUSE-SU-2026:2324-1)	Nessus	SuSE Local Security Checks	high
320421	openSUSE 16 Security Update : perl-XML-LibXML (openSUSE-SU-2026:20908-1)	Nessus	SuSE Local Security Checks	high
319869	Amazon Linux 2023 : perl-XML-LibXML, perl-XML-LibXML-tests (ALAS2023-2026-1795)	Nessus	Amazon Linux Local Security Checks	high
319824	Amazon Linux 2 : perl-XML-LibXML, --advisory ALAS2-2026-3342 (ALAS-2026-3342)	Nessus	Amazon Linux Local Security Checks	high
314185	Linux Distros Unpatched Vulnerability : CVE-2026-8177	Nessus	Misc.	high

Detections

Analytics

CVE-2026-8177

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high