Executive brief
HTML::Bare is a Perl library used for fast HTML parsing. A flaw in how it handles malformed or truncated HTML code can cause the parser to read past the end of its memory buffer. This could lead to application crashes or the unintended exposure of small amounts of memory data when processing untrusted web content.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the `parserc_parse` function within `parser.c` of the HTML::Bare Perl module. The root cause is an unbounded character lookahead where the parser advances the current position pointer (`cpos`) by a fixed amount without verifying if the new offset remains within the allocated buffer. Specifically, the parser advances 9 bytes for CDATA tags after only validating 8, and 2 bytes for self-closing tags (e.g., '<p/') assuming a trailing '>' exists. An attacker providing truncated HTML markup can trigger a heap-buffer-overflow read. Patches have been developed for versions 0.02 and 0.04, though the 'unsafely' variant of the parser remains unpatched by design.
Affected products
- CODECHILD HTML::Bare <= 0.04
Timeline
- 2026-07-15: patched: Pull request with fix submitted to GitHub repository
- 2026-07-16: disclosed: CVE-2026-57073 published