{"id":"CVE-2026-13397","aliases":["EUVD-2026-44963","GHSA-xfxg-9rjg-hqrw"],"status":"published","title":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes","description":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.\n\nThe parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.\n\nNameless attributes such as \"\u003ca ='c'\u003e\" or unbalanced quotes \"\u003ca b='''''''c'\u003e\" can trigger this condition.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00609,"percentile":0.49629,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-835"],"published":"2026-07-16T16:14:14Z","modified":"2026-10-24T20:10:00Z","products":[{"vendor":"codechild","product":"html::bare"}],"references":[{"url":"https://github.com/nanoscopic/perl-HTML-Bare/pull/1","tags":["issue-tracking"]},{"url":"https://security.metacpan.org/patches/H/HTML-Bare/0.02/CVE-2026-13397-r1.patch","tags":["patch"]},{"url":"http://www.openwall.com/lists/oss-security/2026/07/16/4"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13397"},{"url":"https://github.com/advisories/GHSA-xfxg-9rjg-hqrw"}],"sources":{"cve":[{"id":"CVE-2026-13397","title":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes","description":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.\n\nThe parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.\n\nNameless attributes such as \"\u003ca ='c'\u003e\" or unbalanced quotes \"\u003ca b='''''''c'\u003e\" can trigger this condition.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.","status":"published","published":"2026-07-16T16:14:14.891Z","modified":"2026-07-17T13:30:45.877Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-44963","description":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.\n\nThe parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.\n\nNameless attributes such as \"\u003ca ='c'\u003e\" or unbalanced quotes \"\u003ca b='''''''c'\u003e\" can trigger this condition.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.","status":"published","published":"2026-07-16T16:14:14Z","modified":"2026-07-17T13:30:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:50.846094Z"}],"ghsa":[{"id":"GHSA-xfxg-9rjg-hqrw","title":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed...","description":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.\n\nThe parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.\n\nNameless attributes such as \"\u003ca ='c'\u003e\" or unbalanced quotes \"\u003ca b='''''''c'\u003e\" can trigger this condition.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.","status":"published","published":"2026-07-16T18:31:32Z","modified":"2026-07-17T15:33:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:09:35.141236Z"}],"nvd":[{"id":"CVE-2026-13397","description":"HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes.\n\nThe parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever.\n\nNameless attributes such as \"\u003ca ='c'\u003e\" or unbalanced quotes \"\u003ca b='''''''c'\u003e\" can trigger this condition.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.","status":"published","published":"2026-07-16T17:16:55.213Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:12:30.250437Z"}]}}