CVE-2026-57074
XML::Bare versions up to 0.53 for Perl can read past the end of an XML buffer when parsing certain strings. This bug can cause the program to crash or expose data that should be hidden. It is a serious flaw that does not require any special conditions to trigger.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Perl scripts that use the XML::Bare module, version 0.53 or earlier, when parsing XML documents.
Real-world impact
An attacker could craft an XML file that makes the parser read memory beyond the intended buffer, potentially leaking sensitive information or causing the application to crash.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability has a high impact on confidentiality and availability, requires no authentication or user interaction, and is easy to exploit with low effort.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources