PT-2026-35416 · Rrwo · Text::Minify::Xs

Robrwo · Published 2026-04-27 · Updated 2026-04-27 · CVE-2026-7040

Mitre

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Text::Minify::XS versions from v0.3.0 before v0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters.

The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption.

Note that the minify utf8 function is an alias for minnify.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

CWE-176

Related Identifiers

CVE-2026-7040

Affected Products

Text::Minify::Xs

References · 5

• https://github.com/robrwo/Text-Minify-XS/security/advisories/GHSA-jqhf-vv4h-77h2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-7040 · Security Note
• http://openwall.com/lists/oss-security/2026/04/27/5 · Note
• https://twitter.com/CVEnew/status/2048852178777882691 · Twitter Post
• https://metacpan.org/release/RRWO/Text-Minify-XS-v0.7.8/changes · Note