CVE-2026-13397: HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes
HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.
The parsercparse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.
Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.
Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HTML::Bare (Perl)to a version that resolves this vulnerability.Fixed in 0.04 - Compensating control
Ensure untrusted HTML input is not processed by HTML::Bare (e.g., block or sanitize user-controlled HTML) to avoid triggering the infinite loop on malformed attributes such as "<a ='c'>" or "<a b='''''''c'>".
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13397?
CVE-2026-13397 has a high severity rating of 7.5 on the CVSS scale.
How do I fix CVE-2026-13397?
To address CVE-2026-13397, upgrade HTML::Bare to version 0.05 or later.
What type of vulnerability is CVE-2026-13397?
CVE-2026-13397 is a denial-of-service vulnerability that causes the parser to enter an infinite loop.
What software is affected by CVE-2026-13397?
CVE-2026-13397 affects versions of HTML::Bare for Perl up to and including version 0.04.
When was CVE-2026-13397 published?
CVE-2026-13397 was published on July 16, 2026.