CVE-2026-57073
HTML::Bare is a Perl module that parses HTML. Versions up to 0.04 contain a bug that lets attackers read memory beyond the input buffer. This can lead to information disclosure or denial of service.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Perl developers using the HTML::Bare module, especially those using versions 0.04 or earlier, are affected. The module is commonly used in web applications that parse user-supplied HTML.
Real-world impact
An attacker could supply specially crafted HTML that causes the parser to read beyond the buffer, potentially exposing sensitive data or crashing the application.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability is exploitable over the network, requires no user interaction, and can lead to complete compromise of confidentiality and availability.
What to do about it
- 011. Obtain the latest version of HTML::Bare from the project's git repository.
- 022. Install the new version (e.g., using cpanm or CPAN).
- 033. Restart any services that use the module.
NVD description indicates newer versions on git repository.
Timeline
- Jul 16, 2026 · 17d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 19, 2026 · 15d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.