CVE-2026-13401

HighCVSS 7.5

Published: 16/07/2026(UTC)Updated: 17/07/2026(UTC)Translated: 18/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

A vulnerability in the XML::Bare library for Perl (versions up to 0.53) causes an infinite loop when parsing malformed XML attributes. The parserc_parse function fails to advance the attribute-parse state cursor for certain malformed forms, leading to a hang.

Risk Assessment

An attacker can supply a specially crafted XML document that causes the application using XML::Bare to hang, resulting in a denial of service (DoS).

Recommendation

Update the XML::Bare library to a version newer than 0.53 if available, or apply a workaround by validating input data before passing it to the parser.

Other vulnerabilities in XML::Bare

CVE-2026-57074Critical
The vulnerability in the XML::Bare library for Perl (versions up to 0.53) is due to unbounded character lookahead in the parserc_parse function. This function does not check that offsets are within the buffer, which can cause an out-of-bounds read with truncated strings like "<a/".

Original NVD description (English source)

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.