Skip to main content

XML::Bare EUVDEUVD-2026-44964

| CVE-2026-13401 HIGH
Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)
2026-07-16 CPANSec GHSA-8299-xh3w-xhx5
Denial Of Service Suse Xml Codechild
7.5
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Untrusted XML input reaches the parser remotely without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is a pure availability DoS via infinite loop, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
6.2 MEDIUM
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
Jul 17, 2026 - 13:23 vuln.today
Analysis Generated
Jul 17, 2026 - 13:23 vuln.today
CVSS changed
Jul 17, 2026 - 13:22 NVD
7.5 (HIGH)
CVE Published
Jul 16, 2026 - 16:14 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 16, 2026 - 16:14 cve.org
HIGH 7.5

DescriptionCVE.org

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes.

The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.

Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.

AnalysisAI

Denial of service in the Perl XML::Bare module (versions through 0.53) allows remote attackers to force an infinite loop by submitting malformed XML attributes to any application that parses attacker-controlled input with the library. The parserc_parse function fails to advance its cursor on certain malformed attribute forms, causing 100% CPU consumption and unresponsiveness. No public exploit identified at time of analysis, but the trivial reproducer strings published in the oss-security advisory make triggering it straightforward.

Technical ContextAI

XML::Bare is a lightweight, C-backed XML parser for Perl (CPAN distribution codechild/XML-Bare) that prioritizes speed by doing minimal validation. The defect lives in the native parser.c routine parserc_parse, which walks the input character-by-character using a position cursor (cpos). On certain malformed attribute syntaxes the parse-state cursor is never incremented, so the loop condition can never be satisfied - the classic CWE-835 'Loop with Unreachable Exit Condition (Infinite Loop)' root cause. Because the hang occurs in the tokenizing loop before any well-formedness rejection, the parser neither errors out nor returns, permanently pinning the calling thread.

RemediationAI

Patch available per vendor advisory: apply the official fix published at https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch, which corresponds to upstream pull request https://github.com/nanoscopic/perl-XML-Bare/pull/2 adding a cpos++ cursor advance so malformed input can no longer spin forever; upgrade to the fixed CPAN release once published (a released patched version number is not independently confirmed from the provided data). Until a tagged release is installed, compensating controls include wrapping XML::Bare parse calls with a timeout/alarm watchdog to abort runaway parses (trade-off: kills the worker mid-request but frees CPU), enforcing strict input size limits and pre-validating documents with a stricter parser such as libxml2 before handing them to XML::Bare (trade-off: added latency and a second dependency), and restricting or authenticating the endpoints that accept XML so untrusted callers cannot submit attribute payloads. Report was coordinated by CPANSec; see also https://vuldb.com/vuln/379565 and the oss-security thread http://www.openwall.com/lists/oss-security/2026/07/16/2.

More in Xml

View all
CVE-2025-40934 CRITICAL
9.3 Nov 26

XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. Rated critical se
CVE-2026-9390 CRITICAL
9.1 Aug 03

Signature-verification bypass in the Perl XML::Sig module before 0.71 allows remote attackers to forge which document no
CVE-2026-57074 CRITICAL
9.1 Jul 16

Out-of-bounds read in the XML::Bare Perl XML parser (all releases through 0.53) lets a remote attacker crash the parsing
CVE-2026-9487 CRITICAL
9.1 Aug 03

Signature verification bypass in the Perl XML::Sig module before 0.71 allows XML Signature Wrapping (XSW) via duplicate

CVE-2026-18568 HIGH
7.5 Aug 03

Signature verification bypass in XML::Sig (Perl) versions 0.29 through 0.71 allows remote unauthenticated attackers to s
CVE-2026-8177 HIGH
7.5 May 10

Out-of-bounds heap read in XML::LibXML for Perl (all versions through 2.0210) allows remote attackers to trigger denial-

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all
CVE-2024-20353 HIGH POC
8.6
CVE-2020-13935 HIGH POC
7.5
CVE-2017-16944 HIGH POC
7.5
CVE-2022-0778 HIGH POC
7.5
CVE-2024-43366 CRITICAL POC
9.1
CVE-2026-25533 HIGH POC
8.8
CVE-2018-8002 HIGH POC
8.8
CVE-2026-66730 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

EUVD-2026-44964 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy