CVE-2026-57073CWE-125

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead

Critical · published July 16, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
50.7
In the wild
Unconfirmed
What it is

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.

The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00653 · 50.7th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-07-16T16:15Z
EPSS history
Timeline
  • 16 JUL 16:15Z
    HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead
    cvelistv5