Executive brief
XML::Bare is a Perl module used for fast parsing of XML data. A flaw in its C-based parser allows specially crafted, truncated XML strings to cause the library to read memory outside of its intended boundaries. This could lead to application crashes or the unintended exposure of sensitive information stored in the system's memory.
Technical details
An out-of-bounds (OOB) read vulnerability (CWE-125) exists in the parserc_parse function within parser.c of the XML::Bare Perl module. The root cause is an unbounded character lookahead where the parser attempts to identify multicharacter strings (e.g., "<![CDATA") or element terminators (">") without verifying if the offsets remain within the allocated buffer. An attacker providing malformed or truncated XML input, such as "<a/", can trigger a heap-buffer-overflow read. This can be reached via the default XML::Bare->new(text=>$xml)->parse method. Patches have been developed by CPANSec to address the boundary checking.
Affected products
- CODECHILD XML::Bare <= 0.53
Timeline
- 2026-07-14: other: Patch submitted via GitHub pull request
- 2026-07-16: disclosed: CVE published