What is the CVSS score of CVE-2026-13401?

CVE-2026-13401 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of XML::Bare are affected by CVE-2026-13401?

The Perl XML::Bare module (versions ≤0.53) contains a remote denial-of-service vulnerability allowing attackers to exhaust CPU resources and render services unresponsive by submitting malformed XML…. A patch is available.

How to fix or mitigate CVE-2026-13401?

Within 24 hours, scan your infrastructure to identify all applications and services using Perl XML::Bare versions through 0.53 by reviewing package manifests, vendor documentation, and application dependencies. Within 7 days, apply the vendor-released patch to all affected production and staging systems, prioritizing those that handle untrusted XML input. By day 30, verify patch deployment across all environments and establish monitoring for any residual performance degradation related to XML parsing.

XML::Bare CVE-2026-13401

EUVD-2026-44964 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-16 CPANSec

GHSA-8299-xh3w-xhx5

Denial Of Service Suse Xml Codechild

7.5

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Untrusted XML input reaches the parser remotely without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is a pure availability DoS via infinite loop, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 17, 2026 - 13:23 vuln.today

Analysis Generated

Jul 17, 2026 - 13:23 vuln.today

CVSS changed

Jul 17, 2026 - 13:22 NVD

7.5 (HIGH)

CVE Published

Jul 16, 2026 - 16:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 16, 2026 - 16:14 cve.org

HIGH 7.5

DescriptionCVE.org

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes.

The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.

Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.

AnalysisAI

Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop by submitting malformed XML attributes to any application that parses attacker-controlled input with the library. The parserc_parse function fails to advance its cursor on certain malformed attribute forms, causing 100% CPU consumption and unresponsiveness. No public exploit identified at time of analysis, but the trivial reproducer strings published in the oss-security advisory make triggering it straightforward.

Technical ContextAI

XML::Bare is a lightweight, C-backed XML parser for Perl (CPAN distribution codechild/XML-Bare) that prioritizes speed by doing minimal validation. The defect lives in the native parser.c routine parserc_parse, which walks the input character-by-character using a position cursor (cpos). On certain malformed attribute syntaxes the parse-state cursor is never incremented, so the loop condition can never be satisfied - the classic CWE-835 'Loop with Unreachable Exit Condition (Infinite Loop)' root cause. Because the hang occurs in the tokenizing loop before any well-formedness rejection, the parser neither errors out nor returns, permanently pinning the calling thread.

RemediationAI

Patch available per vendor advisory: apply the official fix published at https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch, which corresponds to upstream pull request https://github.com/nanoscopic/perl-XML-Bare/pull/2 adding a cpos++ cursor advance so malformed input can no longer spin forever; upgrade to the fixed CPAN release once published (a released patched version number is not independently confirmed from the provided data). Until a tagged release is installed, compensating controls include wrapping XML::Bare parse calls with a timeout/alarm watchdog to abort runaway parses (trade-off: kills the worker mid-request but frees CPU), enforcing strict input size limits and pre-validating documents with a stricter parser such as libxml2 before handing them to XML::Bare (trade-off: added latency and a second dependency), and restricting or authenticating the endpoints that accept XML so untrusted callers cannot submit attribute payloads. Report was coordinated by CPANSec; see also https://vuldb.com/vuln/379565 and the oss-security thread http://www.openwall.com/lists/oss-security/2026/07/16/2.

More in Xml

View all

CVE-2025-40934 CRITICAL Act Now

9.3 Nov 26

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. Rated critical se

CVE-2026-9390 CRITICAL Act Now

9.1 Aug 03

Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document no

CVE-2026-57074 CRITICAL Act Now

9.1 Jul 16

Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing

CVE-2026-9487 CRITICAL Act Now

9.1 Aug 03

Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate

CVE-2026-18568 HIGH This Week

7.5 Aug 03

Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to s

CVE-2026-8177 HIGH This Week

7.5 May 10

Out-of-bounds heap read in XML::LibXML for Perl (all versions through 2.0210) allows remote attackers to trigger denial-

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all

CVE-2024-20353 HIGH POC

8.6

CVE-2020-13935 HIGH POC

7.5

CVE-2017-16944 HIGH POC

7.5

CVE-2022-0778 HIGH POC

7.5

CVE-2024-43366 CRITICAL POC

9.1

CVE-2026-25533 HIGH POC

8.8

CVE-2018-8002 HIGH POC

8.8

CVE-2026-66730 HIGH POC

8.7

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7	Affected
SUSE Linux Enterprise Server 15 SP7	Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7	Affected

CVE-2026-13401 vulnerability details – vuln.today

Back

XML::Bare CVE-2026-13401

Severity by source

CVSS VectorVendor: CPANSec

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Xml

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code