CVE-2026-57073
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in the HTML::Bare library for Perl (versions up to 0.04) is caused by unbounded character lookahead. The parserc_parse function fails to check that offsets are within the buffer when searching for multicharacter strings like "<![CDATA" or element terminators like ">". Truncated strings such as "<a/" can trigger an out-of-bounds read.
Risk Assessment
The risk involves potential disclosure of sensitive data or application disruption due to an out-of-bounds read. An attacker could exploit this vulnerability to cause a denial of service (DoS) or potentially escalate privileges.
Recommendation
It is recommended to immediately update the HTML::Bare library to the latest version available in the git repository, as version 0.02 on CPAN is vulnerable. Consider temporarily disabling HTML processing functionality if an update is not feasible.
Original NVD description (English source)
HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer. Truncated strings such as "<a/" can trigger an out-of-bounds read. Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.