CVE-2026-7040

HighCVSS 7.5/10Last modified Oct 26, 2026

Description

Text::Minify::XS versions from 0.3.0 before 0.7.8 for Perl have a heap overflow when processing some malformed UTF-8 characters.

The minify functions mishandled some malformed UTF-8 characters, leading to heap corruption.

Note that the minify_utf8 function is an alias for minify.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122CWE-176

Affected software

VendorProductVersions
RRWOText::Minify::XS>= 0.3.0, < 0.7.8

References

Timeline

Published
Apr 27, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-704005.4Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token CVE-2026-704025.8Gitea creates server-side Git hook directories and scripts with mode 0777 and relies on the process umask to restrict access. With a permissCVE-2026-704039.3XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected deCVE-2026-704056.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP snmp allows a remote attacker to degrade availability by sendCVE-2026-704066.5Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repCVE-2026-704074.3Gitea's organization-list API does not enforce the read:organization token scope. A token limited to another category, such as read:misc, caCVE-2026-704088.7An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privilegCVE-2026-704096.3Improper Validation of Specified Quantity in Input vulnerability in Erlang/OTP eldap allows a malicious or compromised LDAP server to degradCVE-2026-70413.7A vulnerability was detected in 666ghj MiroFish up to 0.1.2. The impacted element is an unknown function of the file /console of the componeCVE-2026-704108.8Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantiaCVE-2026-704116.5Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in theCVE-2026-704123.5Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Eras
CVE-2026-7040: High severity, CVSS 7.5 | Vulnix