CVE-2026-13397

HighCVSS 7.5

Published: 16/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

A vulnerability in the HTML::Bare library for Perl (versions up to 0.04) causes an infinite loop when parsing malformed HTML attributes. The parserc_parse function fails to advance the attribute-parse state cursor on certain malformed forms, leading to a hang.

Risk Assessment

An attacker can send specially crafted HTML data with malformed attributes, causing the application using this library to hang, resulting in a denial of service (DoS).

Recommendation

It is recommended to update the HTML::Bare library to the latest version from the git repository, which contains the fix, or apply a workaround by validating input data before passing it to the parser.

Other vulnerabilities in HTML::Bare

CVE-2026-57073Critical
A vulnerability in the HTML::Bare library for Perl (versions up to 0.04) is caused by unbounded character lookahead. The parserc_parse function fails to check that offsets are within the buffer when searching for multicharacter strings like "<![CDATA" or element terminators like ">". Truncated strings such as "<a/" can trigger an out-of-bounds read.

Original NVD description (English source)

HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition. Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.