XML-Parser-2.54

[Bruce Dubbs]

New minor version.

[Joe Locash]

Now at 2.49.

2.48 fixed 2 CVE's:

• GH #39 Fix off-by-one heap buffer overflow in st_serial_stack growth check (CVE-2006-10003)
• GH #64 Fix buffer overflow in parse_stream when filehandle has :utf8 layer (CVE-2006-10002)

The repository is now ​https://github.com/cpan-authors/XML-Parser

[Joe Locash]

Now at 2.51.

[Bruce Dubbs]

Now version 2.52.

[Bruce Dubbs]

Now version 2.53.

[Bruce Dubbs]

Fixed at commits

f3d6527e8 Add a sed to glibc-2.43 (Security update).
7df48f36f Update to XML-Parser-2.53 (Security update).

Leaving both open for security updates.

[Bruce Dubbs]

Reassigning for security advisories.

[Bruce Dubbs]

Now version 2.54.

[Bruce Dubbs]

2.54 2026-03-27 (by Todd Rinaldo)

Fixes:

• Plug XS memory leaks on error paths in Expat.xs (externalEntityRef, parse_stream, ParserCreate)
• Add defensive NULL checks in Expat.xs to prevent crashes on memory exhaustion and undefined behavior on short input lines
• Add explicit package main after inline package declarations in test files to clarify scope

Improvements:

• Add GitHub Actions workflow to auto-create GitHub Releases on tag push, enabling downstream notification via GitHub's release watch
• Update AUTHORS POD in Parser.pm and Expat.pm to reflect full maintainer history
• Add CI badge to POD via =for markdown directive so it survives README.md regeneration
• Rename README to README.md and regenerate from POD

Maintenance:

• Modernize 10 legacy test files from print-ok style to Test::More (cdata, finish, deep_nesting, xml_escape, partial, char_end_doc, current_length, combine_chars, utf8_stream, defaulted)

[Bruce Dubbs]

Fixed at commit 2c1f428b94 but leaving open for SA.

XML-Parser-2.54
perl-5.42.2

[Douglas R. Reno]

SA-13.0-020 issued.

This advisory will need to be updated once XML-Parser and intltool have been moved to BLFS.