CVE-2026-57073

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.

The parserc_parse function attempts to check for multicharacter strings such as "<![CDATA" or element terminators such as ">" without checking that the offsets are within the buffer.

Truncated strings such as "<a/" can trigger an out-of-bounds read.

Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-570749.1XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharaCVE-2026-570759.1YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decCVE-2026-570767.8YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchCVE-2026-570777.7YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck nCVE-2026-570795.3Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata. NetCVE-2026-57088.8Unsanitized control of user-modifiable attributes in the session creation component in AWS Research and Engineering Studio (RES) prior to veCVE-2026-570807.5Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix. The peer-wiCVE-2026-570817.5Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input. bdecode recurses once per CVE-2026-570825.9Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG. The MSE (Message CVE-2026-570835.5Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.CVE-2026-570845.5Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally.CVE-2026-570853.3Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally.