Log in Start free

Vulnerability · Published Jul 16, 2026 · Assigned by CPANSec

CVE-2026-57074XML::Bare versions through 0.53 for Perl have an unbounded character lookahead

Critical 9.1

In plain English

A critical-severity out-of-bounds read in XML::Bare from CODECHILD. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)0.6%top 49.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer. Truncated strings such as "<a/" can trigger an out-of-bounds read.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libxml-bare-perlno fix listedDEBIAN-CVE-2026-57074
Debian:13libxml-bare-perlno fix listedDEBIAN-CVE-2026-57074
Debian:14libxml-bare-perl0.53-5DEBIAN-CVE-2026-57074
Ubuntu:22.04:LTSlibxml-bare-perlno fix listedUBUNTU-CVE-2026-57074
Ubuntu:24.04:LTSlibxml-bare-perlno fix listedUBUNTU-CVE-2026-57074
Ubuntu:26.04:LTSlibxml-bare-perlno fix listedUBUNTU-CVE-2026-57074
Ubuntu:26.10libxml-bare-perlno fix listedUBUNTU-CVE-2026-57074

Affected products (as reported)

VendorProductVersions
CODECHILD XML::Bare 0 – through 0.53

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References