Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-57074: XML::Bare for Perl may read past data and crash
CVE-2026-57074 · published 3 months ago
Summary
The XML::Bare library used in Perl can read beyond the end of a data buffer when it encounters an incomplete tag. This can cause the program to crash or become unstable, potentially interrupting your applications. Update to a newer version of the library or apply the vendor’s patch to stop the out‑of‑bounds read.
What to do
- Update debian libxml-bare-perl to version 0.53-5.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:13 | debian | libxml-bare-perl | All versions |
| Debian:14 | debian | libxml-bare-perl |
< 0.53-5 Fix: upgrade to 0.53-5
|
| – | codechild | xml::bare | <= 0.53 |
| Debian:11 | debian | libxml-bare-perl | All versions |
| Debian:12 | debian | libxml-bare-perl | All versions |
| Ubuntu:16.04:LTS | canonical | libxml-bare-perl | All versions |
| Ubuntu:18.04:LTS | canonical | libxml-bare-perl | All versions |
| Ubuntu:20.04:LTS | canonical | libxml-bare-perl | All versions |
| Ubuntu:22.04:LTS | canonical | libxml-bare-perl | All versions |
| Ubuntu:24.04:LTS | canonical | libxml-bare-perl | All versions |
| Ubuntu:26.04:LTS | canonical | libxml-bare-perl | All versions |
Original advisory text
XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators su...
XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer. Truncated strings such as "<a/" can trigger an out-of-bounds read.
References
- https://github.com/nanoscopic/perl-XML-Bare/pull/1
- https://security.metacpan.org/patches/X/XML-Bare/0.53/CVE-2026-57074-r1.patch
- http://www.openwall.com/lists/oss-security/2026/07/16/1
- https://security-tracker.debian.org/tracker/CVE-2026-57074 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-57074 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-57074 Third Party Advisory
- https://lists.security.metacpan.org/cve-announce/msg/41876806/ Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
9.1
Critical
Type
CWE-125Out-of-bounds Read
Timeline
Published16 Jul 2026
Updated30 Oct 2026
First seen16 Jul 2026
Sources
CVE-2026-57074 · NVD
CVE-2026-57074 · MITRE
UBUNTU-CVE-2026-57074 · OSV
DEBIAN-CVE-2026-57074 · OSV
Track software like this
Free during beta