CVE-2026-57074

CRITICAL9.1

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead

Published Jul 16, 2026

Modified 4 days ago

Details

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead.

The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

References

WEB

http://www.openwall.com/lists/oss-security/2026/07/16/1

WEB

https://github.com/nanoscopic/perl-XML-Bare/pull/1

FIX

https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-57074

CVSS Analysis

CVSS v3.1

9.1

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

HighA:H

9.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness Type (CWE)

Memory Safety

CWE-125

Out-of-bounds Read

Ecosystems

Timeline

PublishedJul 16, 2026

ModifiedJul 17, 2026