CVE-2015-5523: The ParseValue function in lexer.c in tidy before 4.9.31 allows remote attackers to cause a denial of servi...

Security readout for executives and security teams

CVE-2015-5523 is a denial-of-service flaw in tidy before 4.9.31. A specially malformed HTML input can make the parser crash by triggering an excessive memory allocation. Business impact is mainly service disruption where tidy processes untrusted HTML. Exposure is most likely in systems, products, or scripts that run tidy/libtidy/tidy-html5 against remotely supplied or user-generated HTML. Distribution and vendor advisories from Ubuntu, Debian, and Apple indicate bundled downstream exposure existed. Prioritize remediation for internet-facing services or automated pipelines that parse untrusted HTML. This is not shown as actively exploited, but it can affect availability and may be easy to trigger in exposed parsing workflows. Mitigation focus: Upgrade tidy to 4.9.31 or later where directly managed.; Apply relevant vendor security updates for packaged tidy components.; Limit processing of untrusted HTML until affected instances are updated..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.