VulnSocial

CVE-2026-57073Disclosure

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer. Truncated strings such as "<a/" can trigger an out-of-bounds read. Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-19: 1Technical Details · 2026-07-19: 107-19
Signal classification1 categories
Disclosure
1100.0%
Referenced assets2 URLs
Full discourse1 post
  • Open Source Security mailing list@oss_security
    Disclosure

    Perl CPAN HTML::Bare through 0.04 CVE-2026-57073: Unbounded character lookahead https://www.openwall.com/lists/oss-security/2026/07/16/3 CVE-2026-13397: Hang in an infinite loop when parsing malformed attributes https://www.openwall.com/lists/oss-security/2026/07/16/4

    Post summary

    Perl CPAN’s HTML::Bare 0.04 receives two new CVE disclosures describing an unbounded character lookahead and an infinite loop on malformed attributes, both raising denial‑of‑service concerns; no PoC, exploit, patch or active exploitation evidence is given.

    1000067
    4.7K followersView on X

Explore more

Back to dashboard