CVE-2026-8177 is an out-of-bounds read vulnerability in XML::LibXML for Perl (versions up to 2.0210). The flaw occurs when parsing XML node names that end in the middle of a multi-byte UTF-8 sequence, causing the parser to read past the end of the input string into adjacent heap memory. This can lead to a crash of the Perl process using XML::LibXML's DOM node-name methods with attacker-controlled input, resulting in denial of service. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to availability. Red Hat has issued security advisories and updates for their supported platforms to fix this issue.

The vulnerability can cause a denial of service by crashing Perl processes that parse specially crafted XML node names containing truncated UTF-8 sequences. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported at this time.

Red Hat has released security updates for XML::LibXML in Red Hat Enterprise Linux 10 to address this vulnerability. Users should apply the official patches provided by Red Hat as detailed in their advisory (RHSA-2026:39547). Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.