XML::Bare CVE-2026-13401

Exploitation requires that the target application parse attacker-supplied XML using XML::Bare 0.53 or earlier, and that the attacker can deliver a document containing a malformed attribute - specifically a nameless attribute (e.g. "<a ='c'>") or an attribute with unbalanced quotes (e.g. "<a b='''''''c'>"). No authentication, user interaction, or non-default library configuration is needed (PR:N/UI:N), and the malicious input is a tiny well-formed-looking fragment. The principal limiting factor is deployment: the vulnerability is only reachable where untrusted XML flows into XML::Bare's parser, so services that only parse trusted internal XML are not practically exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) reflects a pure availability impact: no confidentiality or integrity loss, but a single crafted document can wedge a worker process. Network exploitability and low attack complexity are realistic only where an application actually feeds untrusted XML into XML::Bare - that deployment dependency, not the library flaw itself, is the true gating factor. No EPSS score, KEV listing, or SSVC decision data was provided; absence of KEV means there is no evidence of active exploitation, and no POC file was supplied, though the advisory publishes trigger strings that function as a proof of concept. This is a genuine availability risk for exposed Perl services but not a mass-exploitation or RCE-class emergency - priority should scale with whether the affected service parses external XML.

An attacker sends a small XML document containing a nameless attribute such as "<a ='c'>" or an unbalanced-quote attribute like "<a b='''''''c'>" to a web service, API, or job processor that parses the body with XML::Bare. The parser enters parserc_parse and loops forever without advancing its cursor, pinning a CPU core and hanging that worker; repeating the request across workers exhausts the service. The advisory's published trigger strings serve as a working proof of concept, and the low-complexity, unauthenticated network vector makes delivery trivial.