Skip to main content

XML::Bare CVE-2026-57074

| EUVDEUVD-2026-44966 CRITICAL
Out-of-bounds Read (CWE-125)
2026-07-16 CPANSec GHSA-xm8x-vw7j-573w
Buffer Overflow Information Disclosure Suse Xml Codechild
Critical
Disputed · 9.1 Vendor: CPANSec
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (CPANSec) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.5 MEDIUM

Unauthenticated malformed-XML input (PR:N/UI:N/AC:L); network vector holds only when XML is remote; bounded lookahead over-read yields limited disclosure and crash, so C:L/A:L, I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 17, 2026 - 21:31 vuln.today
Analysis Generated
Jul 17, 2026 - 21:31 vuln.today
CVSS changed
Jul 17, 2026 - 19:22 NVD
9.1 (CRITICAL)
CVE Published
Jul 16, 2026 - 16:15 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 16, 2026 - 16:15 cve.org
CRITICAL 9.1

DescriptionCVE.org

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead.

The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

AnalysisAI

Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing process or disclose small amounts of adjacent process memory by feeding it a truncated or malformed XML document. The parserc_parse C routine performs multi-character lookahead (for tokens like '<![CDATA[' and element terminators) without verifying the offsets stay inside the input buffer, so inputs such as '<a/' read past the end. There is no public exploit identified at time of analysis and EPSS is low (0.19%), but SSVC rates the flaw automatable, reflecting how easily malformed XML can be delivered to any service that parses untrusted input with this module.

Technical ContextAI

XML::Bare is a lightweight CPAN XML parser for Perl whose performance-critical parsing is implemented in C (parser.c). The vulnerable parserc_parse function walks the input with a cursor (cpos) and peeks ahead several bytes to recognize constructs - for example it tests cpos+7 for the 'A' in '<![CDATA[' and elsewhere assumes the byte after a token is '>' before advancing cpos+=2. Because these dereferences and pointer advances are not bounds-checked against the NUL terminator or buffer length, a truncated tail such as '<a/' causes reads (and cursor advancement) past the allocated buffer. This is a classic CWE-125 out-of-bounds read: the root cause is trusting structural assumptions about well-formed XML rather than validating each offset before dereferencing. The affected component is identified by CPE cpe:2.3:a:codechild:xml::bare (CPAN distribution XML-Bare).

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - no exact fixed release number is present in the provided data. Apply the CPANSec-published patch at https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch, or pull the upstream change in https://github.com/nanoscopic/perl-XML-Bare/pull/1, which adds bounds checks: requiring the full '<![CDATA[' sequence (checking cpos+8 == '[') before advancing, and advancing past an assumed '>' only when the next byte is non-NUL (if(*(cpos+1)) cpos+=2; else cpos++) so a truncated tail cannot skip past the terminator. Rebuild the XS/C module after patching. Where you cannot patch immediately, reduce exposure by not feeding untrusted or externally sourced XML to XML::Bare - validate and size-check input and reject truncated or malformed documents upstream, or route untrusted XML through a hardened parser such as libxml2-based XML::LibXML instead; the trade-off is added dependency weight and possible behavioral or API differences from XML::Bare's lenient parsing. Monitor CPAN for a tagged release that incorporates this patch and upgrade to it once published.

More in Xml

View all
CVE-2025-40934 CRITICAL
9.3 Nov 26

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. Rated critical se
CVE-2026-9390 CRITICAL
9.1 Aug 03

Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document no
CVE-2026-9487 CRITICAL
9.1 Aug 03

Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate

CVE-2026-18568 HIGH
7.5 Aug 03

Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to s
CVE-2026-8177 HIGH
7.5 May 10

Out-of-bounds heap read in XML::LibXML for Perl (all versions through 2.0210) allows remote attackers to trigger denial-
CVE-2026-13401 HIGH
7.5 Jul 16

Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

CVE-2026-57074 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy