CVE-2026-13401: XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-16 · updated 2026-10-24
Weakness: CWE-835

Description

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.

Affected products

CODECHILD XML::Bare: through 0.53

References

https://github.com/nanoscopic/perl-XML-Bare/pull/2
https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-13401-r1.patch
http://www.openwall.com/lists/oss-security/2026/07/16/2

Get alerted when CVE-2026-13401 or the next vulnerability affects your stack