XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the default API. The likely consequence is a crash, causing denial of service.

The remote SUSE Linux SLES12 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2026:2402-1 advisory.

    This update for perl-XML-LibXML fixes the following issue

    - CVE-2026-8177: read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8     byte sequences       (bsc#1264715).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:2324-1 advisory.

    This update for perl-XML-LibXML fixes the following issue

    - CVE-2026-8177: read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8     byte sequences       (bsc#1264715).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20908-1 advisory.

    This update for perl-XML-LibXML fixes the following issue

    - CVE-2026-8177: read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8     byte sequences       (bsc#1264715).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1795 advisory.

    XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names     containing truncated UTF-8 byte sequences.

    A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of     the input string into adjacent heap memory.

    Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach     this path on the default API. The likely consequence is a crash, causing denial of service.
    (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl-XML-LibXML installed on the remote host is prior to 2.0018-5. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3342 advisory.

    XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names     containing truncated UTF-8 byte sequences.

    A node name ending in the middle of a multi byte UTF-8 sequence causes the parser to read past the end of     the input string into adjacent heap memory.

    Any Perl process that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach     this path on the default API. The likely consequence is a crash, causing denial of service.
    (CVE-2026-8177)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names     containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi byte UTF-8 sequence     causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process     that passes attacker controlled strings to XML::LibXML's DOM node-name methods can reach this path on the     default API. The likely consequence is a crash, causing denial of service. (CVE-2026-8177)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321583	SUSE SLES12 Security Update : perl-XML-LibXML (SUSE-SU-2026:2402-1)	Nessus	SuSE Local Security Checks	high
321016	SUSE SLED15 / SLES15 Security Update : perl-XML-LibXML (SUSE-SU-2026:2324-1)	Nessus	SuSE Local Security Checks	high
320421	openSUSE 16 Security Update : perl-XML-LibXML (openSUSE-SU-2026:20908-1)	Nessus	SuSE Local Security Checks	high
319869	Amazon Linux 2023 : perl-XML-LibXML, perl-XML-LibXML-tests (ALAS2023-2026-1795)	Nessus	Amazon Linux Local Security Checks	high
319824	Amazon Linux 2 : perl-XML-LibXML, --advisory ALAS2-2026-3342 (ALAS-2026-3342)	Nessus	Amazon Linux Local Security Checks	high
314185	Linux Distros Unpatched Vulnerability : CVE-2026-8177	Nessus	Misc.	high

Detections

Analytics

CVE-2026-8177

high

Tenable Plugins

high

high

high

high

high

high