CVE-2009-3627: Derrick Oswald Html-Parser

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character.

Affected products

• Derrick Oswald Html-Parser: up to and including 3.54; version 1.00 only; version 1.1 only; version 1.2 only; version 1.3 only; version 1.4 only; …

Published 2009-10-29. Last modified 2026-06-16.