CVE-2026-57073: HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead
HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.
The parsercparse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.
Truncated strings such as "<a/" can trigger an out-of-bounds read.
Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl HTML::Bareto a version that resolves this vulnerability.Fixed in 0.04 - Upgrade
Upgrade
Perl HTML::Bareto a version that resolves this vulnerability.Fixed in 0.02
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57073?
CVE-2026-57073 is rated with a risk score of 17.
How do I fix CVE-2026-57073?
To fix CVE-2026-57073, upgrade HTML::Bare to version 0.05 or later.
What software is affected by CVE-2026-57073?
CVE-2026-57073 affects versions of HTML::Bare up to and including 0.04 for Perl.
What kind of vulnerability is CVE-2026-57073?
CVE-2026-57073 is an unbounded character lookahead vulnerability in the HTML::Bare parser.
What are the potential impacts of CVE-2026-57073?
Exploitation of CVE-2026-57073 can result in invalid parsing and potentially cause denial of service.