EUVD-2026-44963
GHSA-xfxg-9rjg-hqrw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A single crafted string reliably triggers an infinite loop with no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only CPU exhaustion, so C:N/I:N/A:H.
Primary rating from Vendor (CPANSec).
CVSS VectorVendor: CPANSec
Lifecycle Timeline
5DescriptionCVE.org
HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.
The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.
Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.
Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.
AnalysisAI
Denial of service in HTML::Bare through version 0.04, a Perl XML/HTML parsing module, allows remote unauthenticated attackers to hang the parsing process in an infinite loop by supplying malformed markup. The parserc_parse function fails to advance its attribute-parse cursor on certain malformed attribute forms - such as nameless attributes ("<a ='c'>") or unbalanced quotes ("<a b='''''''c'>") - causing the CPU to spin indefinitely. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.19%, 8th percentile), consistent with a resource-exhaustion bug rather than a high-value target.
Technical ContextAI
HTML::Bare is a lightweight Perl module (CPE cpe:2.3:a:codechild:html::bare) that parses XML/HTML into a Perl data structure, using a C backend (parser.c) for speed. The root cause is CWE-835 (Loop with Unreachable Exit Condition, i.e. an infinite loop): the C function parserc_parse contains an attribute-parsing state machine whose cursor (cpos) is never incremented on specific malformed attribute forms - notably when a quoted attribute name is not followed by an '=' sign. Because the exit condition of the loop depends on the cursor advancing past the input, the loop can never terminate. The upstream fix (PR #1) is a single line, cpos++, that forces the cursor forward so malformed input cannot spin forever.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the one-line cursor-advance fix from https://github.com/nanoscopic/perl-HTML-Bare/pull/1 or the MetaCPAN security patch at https://security.metacpan.org/patches/H/HTML-Bare/0.02/CVE-2026-13397-r1.patch (note this patch is issued against 0.02, the current CPAN release). Because no tagged, fixed CPAN release is confirmed, teams relying on CPAN cannot simply bump a version and should either apply the patch to their vendored copy or pin to the fixed git commit. As a compensating control until patched, wrap parser calls with a hard timeout (e.g. Perl's alarm()/SIGALRM or Sys::SigAction around the parse call) so a hung parse is killed rather than pinning a worker indefinitely - trade-off: legitimately large documents may be aborted, so tune the timeout. Additionally, size-limit and validate untrusted markup before parsing and run parsing in a separate worker/process that can be reaped, to contain the CPU/resource impact of a single request.
Heap memory disclosure in the Perl HTML::Gumbo module before 0.19 lets remote attackers leak bounded chunks of process h
The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can
Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated
Session::Cookie in the HTML::EP module 0.2011 for Perl does not properly use the Storable::thaw function, which allows r
Heap information disclosure in HTML::Entities for Perl (versions before 3.84) allows remote attackers to leak adjacent h
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and applic
Html contains a vulnerability that allows attackers to denial of service (DoS) if an attacker provides specially crafted
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today