What is the CVSS score of CVE-2026-57073?

CVE-2026-57073 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of HTML::Bare are affected by CVE-2026-57073?

HTML::Bare, a Perl HTML parsing module in versions 0.04 and earlier, contains a critical out-of-bounds memory read flaw that could expose sensitive data or crash services.. A patch is available.

How to fix or mitigate CVE-2026-57073?

Within 24 hours, identify all systems and applications using HTML::Bare module versions through 0.04 and determine exposure based on whether they process untrusted HTML. Within 7 days, apply the available vendor patch to update HTML::Bare to the patched release. Within 30 days, complete testing of patched systems to validate HTML parsing functionality and establish a process for maintaining current versions of Perl module dependencies.

HTML::Bare CVE-2026-57073

EUVD-2026-44965 CRITICAL

Out-of-bounds Read (CWE-125)

2026-07-16 CPANSec

GHSA-682p-jxjc-9j4v

Buffer Overflow Information Disclosure Html Codechild

9.1

CVSS 3.1 · Vendor: CPANSec

Severity by source

Vendor (CPANSec) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable if the app parses untrusted HTML (AV:N/AC:L/PR:N/UI:N), but a small bounded over-read yields only limited disclosure (C:L) and a likely crash (A:L), not high impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 17, 2026 - 13:23 vuln.today

Analysis Generated

Jul 17, 2026 - 13:23 vuln.today

CVSS changed

Jul 17, 2026 - 13:22 NVD

9.1 (CRITICAL)

CVE Published

Jul 16, 2026 - 16:15 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 16, 2026 - 16:15 cve.org

CRITICAL 9.1

DescriptionCVE.org

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.

The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

AnalysisAI

Out-of-bounds read in the HTML::Bare Perl parsing module (versions through 0.04) lets an attacker who supplies truncated or malformed HTML - such as the string "<a/" - force the C-based parserc_parse routine to read past the end of the input buffer. Because the parser performs multi-character lookahead for tokens like "<![CDATA" and element terminators ">" without bounds checks, adjacent heap memory can be disclosed or the process can crash. No public exploit was identified at time of analysis, but an upstream fix (GitHub PR #2) and per-version patches are available.

Technical ContextAI

HTML::Bare is a Perl module whose parsing hot-path is implemented in C (parser.c) for speed, exposing it to classic memory-safety bugs. The root cause is CWE-125 (Out-of-Bounds Read): parserc_parse dereferences fixed offsets from the current cursor - e.g. *(cpos+7)/*(cpos+8) when matching "<![CDATA[", and blind cpos+=2 advances that assume the next byte is '>' - without first confirming those offsets fall inside the NUL-terminated buffer. When input is truncated (e.g. "<a/" or a tag whose assumed '>' is actually the NUL terminator), the cursor advances past the string boundary and subsequent reads touch memory beyond the allocation. The CPE cpe:2.3:a:codechild:html::bare identifies the affected package; the fix adds the missing terminator/NUL checks (require the full "<![CDATA[" before skipping 9 bytes, and only skip the assumed '>' when *(cpos+1) is non-NUL).

RemediationAI

Patch available per vendor advisory: apply the CPANSec-published fixes rather than waiting for a tagged release - https://security.metacpan.org/patches/H/HTML-Bare/0.02/CVE-2026-57073-r1.patch for CPAN 0.02 and https://security.metacpan.org/patches/H/HTML-Bare/0.04/CVE-2026-57073-r2.patch for the git 0.04 line, both corresponding to upstream fix PR https://github.com/nanoscopic/perl-HTML-Bare/pull/2. Because no fixed version is published to CPAN, this is best described as an upstream fix (PR/patch) rather than an independently confirmed released version, so pin to the patched source or vendor the corrected parser.c into your build. If you cannot patch immediately, the practical compensating control is to stop passing untrusted input to the C parser: validate/size-cap input length and reject truncated tags before parsing, or switch to the pure-Perl parse path if your integration exposes one (trade-off: slower parsing), and isolate any service that parses attacker-controlled HTML so a crash cannot cascade. See the oss-security advisory https://seclists.org/oss-sec/2026/q3/155 for coordination details.