CVE-2026-13593: CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-10-25
Weakness: CWE-401

Description

CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory leak when processing a document containing only characters to be removed, such as comments and whitespace.

Affected products

GTERMARS CSS::Minifier::XS: before 0.14 — fixed in 0.14

How to fix

Upgrade to a fixed version: GTERMARS CSS::Minifier::XS 0.14. Check the vendor advisory for mitigations.

References

https://metacpan.org/release/GTERMARS/CSS-Minifier-XS-0.14/changes
http://www.openwall.com/lists/oss-security/2026/06/29/18

Get alerted when CVE-2026-13593 or the next vulnerability affects your stack