PatchTheCVECVE-2015-8978: In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining
CVE-2015-8978 is a high-severity flaw (CVSS 7.5) affecting \. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to one billion copies of the first entity. The amount of computer memory used for handling an external SOAP call would likely exceed that available to the process parsing
Why this priority
- High severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.6% (top 25%) |
| CISA exploited list | No |
| Weakness | CWE-399 |
| Published | 2016-11-22 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2015-8978?
\: upgrade to newer than 1.14. Exact commands for each OS are on this page.
Is CVE-2015-8978 being exploited?
CVE-2015-8978 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2015-8978 affect?
CVE-2015-8978 affects \. Severity is high (CVSS 7.5). In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 and earlier, an example attack consists of defining 10 or more XML entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instanc
How urgent is CVE-2015-8978?
Priority 50/100. High severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-9390 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in
- CVE-2026-9487 CRITICAL 9.1 UPGRADE XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XM
- CVE-2026-18568 HIGH 7.5 UPGRADE XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns tr
- CVE-2025-40934 CRITICAL 9.3 UPGRADE XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An att
- CVE-2026-42497 HIGH 7.5 UPGRADE Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extracti