HTML::Bare CVE-2026-57073

Exploitation requires that the target application pass attacker-controlled input to HTML::Bare's C parser (parserc_parse). The concrete trigger is a truncated or malformed token: a fragment like "<a/" whose assumed closing '>' is actually the buffer's NUL terminator, or a partial "<![CDATA" sequence at the end of the buffer - either causes lookahead reads at offsets (cpos+7, cpos+8, cpos+2) that fall outside the allocation. Limiting factors: this is a library, not a standalone service, so there are no special product configuration flags - the real prerequisite is a calling application that (a) uses the vulnerable C parse path and (b) parses untrusted, un-length-validated HTML. Impact is bounded by how few bytes past the buffer are read, favoring crashes over large-scale disclosure.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H, base 9.1) rates this critical on the assumption that untrusted HTML reaches the parser over the network with no authentication and yields high confidentiality and availability impact. That is plausible for a library embedded in a web-facing service, but the real-world severity is entirely context-dependent: HTML::Bare is a library, so exploitability requires that the consuming application feed attacker-controlled input to the parser - an attack requirement the base score does not capture. The C:H rating is optimistic for a bug that reads a small, bounded number of bytes past the buffer; realistic outcomes are limited heap disclosure and, more reliably, a crash (availability). No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit was identified - signals that point to lower immediate real-world urgency than the 9.1 suggests. Treat this as a genuine memory-safety defect worth patching, but calibrate priority to whether your deployment actually parses untrusted HTML with this module.

An application uses HTML::Bare to parse HTML or XML-like content submitted by users - for example an API endpoint or feed processor. An attacker submits a deliberately truncated fragment such as "<a/" or a tag missing its closing '>', causing parserc_parse to read beyond the input buffer and either crash the worker (denial of service) or leak adjacent heap bytes back into parsed output. No public proof-of-concept was identified, but the trigger is trivial to craft and requires only network-delivered input with no authentication.