Source: libxml-bare-perl Version: 0.53-4 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Control: found -1 0.53-2 Control: found -1 0.53-1
Hi, The following vulnerabilities were published for libxml-bare-perl. CVE-2026-13401[0]: | XML::Bare versions through 0.53 for Perl will hang in an infinite | loop when parsing malformed attributes. The parserc_parse function | never advances the attribute-parse state cursor on certain malformed | attribute forms, looping forever. Nameless attributes such as "<a | ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this | condition. CVE-2026-57074[1]: | XML::Bare versions through 0.53 for Perl have an unbounded character | lookahead. The parserc_parse function attempts to check for | multicharacter strings such as "<![CDATA" or element terminators | such as ">" without checking that the offsets are within the buffer. | Truncated strings such as "<a/" can trigger an out-of-bounds read. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-13401 https://www.cve.org/CVERecord?id=CVE-2026-13401 [1] https://security-tracker.debian.org/tracker/CVE-2026-57074 https://www.cve.org/CVERecord?id=CVE-2026-57074 Regards, Salvatore
