Executive brief
CSS::Minifier::XS is a Perl library used to compress CSS files to make websites load faster. A flaw in the software causes it to leak memory when processing files that contain only comments or whitespace. Over time, this could lead to increased memory usage and potential service instability if the library is used to process many such files.
Technical details
A memory leak (CWE-401) exists in the minify() function of CSS::Minifier::XS before version 0.14. The vulnerability is triggered when the input document consists entirely of characters that are removed during the minification process, such as comments and whitespace. An attacker could potentially exploit this by repeatedly submitting such documents to a service using this library, leading to gradual memory exhaustion. The issue was addressed in version 0.14 by ensuring memory is correctly released when the resulting output is empty.
Affected products
- GTERMARS CSS::Minifier::XS < 0.14
Timeline
- 2026-06-28: patched: Version 0.14 released to fix the leak.
- 2026-06-29: disclosed: CVE-2026-13593 published.