CVE-2006-10003: Critical buffer overflow in Perl XML::Parser - Immediate Update Required

Summary

Parameter	Value
CVE ID	CVE-2006-10003
Alert Source	GitHub Advisory - Critical Vulnerability
CVE Publication Year	2006
Date Published	2026-03-19
Vendor	Perl
Product	XML::Parser
CVSS Score	9.8 (critical)
EPSS Score	0.0% (percentile: 5%)
CISA KEV	No
Ransomware	Not confirmed

Vulnerability Description

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack.

In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer.

The bug can be observed when parsing an XML file with very deep element nesting

Required Actions

Apply vendor patches or mitigations as soon as available.

Who Is Affected?

This vulnerability affects XML::Parser by Perl. Check if your organization uses this software and requires updates.

Sources

• NVD - CVE-2006-10003

• FIRST EPSS

---

Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.

How can nFlo help?

If your organization uses products affected by this vulnerability, contact us. We can help with:

• Verifying whether your systems are at risk
• Implementing patches and risk mitigation
• Monitoring for exploitation attempts in your environment

Useful resources:

• Incident response management
• SOC — Security Operations Center
• nFlo penetration testing