CVE-2026-57073

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57073", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-06-23T17:59:40.467Z", "datePublished": "2026-07-16T16:15:16.551Z", "dateUpdated": "2026-07-17T12:44:26.715Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "HTML-Bare", "product": "HTML::Bare", "programFiles": ["parser.c"], "programRoutines": [{"name": "parserc_parse"}], "repo": "https://github.com/nanoscopic/perl-HTML-Bare", "vendor": "CODECHILD", "versions": [{"lessThanOrEqual": "0.04", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.\n\nThe parserc_parse function attempts to check for multicharacter strings such as \"<![CDATA\" or element terminators such as \">\" without checking that the offsets are within the buffer.\n\nTruncated strings such as \"<a/\" can trigger an out-of-bounds read.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository."}], "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-16T16:15:16.551Z"}, "references": [{"tags": ["issue-tracking"], "url": "https://github.com/nanoscopic/perl-HTML-Bare/pull/2"}, {"tags": ["patch"], "url": "https://security.metacpan.org/patches/H/HTML-Bare/0.02/CVE-2026-57073-r1.patch"}, {"tags": ["patch"], "url": "https://security.metacpan.org/patches/H/HTML-Bare/0.04/CVE-2026-57073-r2.patch"}], "source": {"discovery": "UNKNOWN"}, "title": "HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead", "workarounds": [{"lang": "en", "value": "Apply the patch to version 0.02 (from CPAN) or version 0.04 (from the git repository)."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/16/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-16T19:27:58.902Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-17T12:44:11.342365Z", "id": "CVE-2026-57073", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T12:44:26.715Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/16/3"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-16T19:27:58.902Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-57073", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-17T12:44:11.342365Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T12:43:51.239Z"}}], "cna": {"title": "HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-540", "descriptions": [{"lang": "en", "value": "CAPEC-540 Overread Buffers"}]}], "affected": [{"repo": "https://github.com/nanoscopic/perl-HTML-Bare", "vendor": "CODECHILD", "product": "HTML::Bare", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "0.04"}], "packageName": "HTML-Bare", "programFiles": ["parser.c"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "parserc_parse"}]}], "references": [{"url": "https://github.com/nanoscopic/perl-HTML-Bare/pull/2", "tags": ["issue-tracking"]}, {"url": "https://security.metacpan.org/patches/H/HTML-Bare/0.02/CVE-2026-57073-r1.patch", "tags": ["patch"]}, {"url": "https://security.metacpan.org/patches/H/HTML-Bare/0.04/CVE-2026-57073-r2.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "Apply the patch to version 0.02 (from CPAN) or version 0.04 (from the git repository)."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.\n\nThe parserc_parse function attempts to check for multicharacter strings such as \"<![CDATA\" or element terminators such as \">\" without checking that the offsets are within the buffer.\n\nTruncated strings such as \"<a/\" can trigger an out-of-bounds read.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-07-16T16:15:16.551Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57073", "state": "PUBLISHED", "dateUpdated": "2026-07-17T12:44:26.715Z", "dateReserved": "2026-06-23T17:59:40.467Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-07-16T16:15:16.551Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "HTML-Bare", "product": "HTML::Bare", "programFiles": ["parser.c"], "programRoutines": [{"name": "parserc_parse"}], "repo": "https://github.com/nanoscopic/perl-HTML-Bare", "vendor": "CODECHILD", "versions": [{"lessThanOrEqual": "0.04", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead.\n\nThe parserc_parse function attempts to check for multicharacter strings such as \"<![CDATA\" or element terminators such as \">\" without checking that the offsets are within the buffer.\n\nTruncated strings such as \"<a/\" can trigger an out-of-bounds read.\n\nNote that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository."}, {"lang": "es", "value": "Las versiones de HTML::Bare hasta la 0.04 para Perl tienen una anticipaci\u00f3n de caracteres no acotada.\n\nLa funci\u00f3n parserc_parse intenta verificar cadenas de m\u00faltiples caracteres como \u2019<![CDATA\u2019 o terminadores de elementos como \u2019>\u2019 sin comprobar que los desplazamientos est\u00e9n dentro del b\u00fafer.\n\nCadenas truncadas como \u2019<a/\u2019 pueden desencadenar una lectura fuera de l\u00edmites.\n\nTenga en cuenta que la \u00faltima versi\u00f3n disponible en CPAN es la versi\u00f3n 0.02. Las versiones m\u00e1s recientes est\u00e1n disponibles en el repositorio git."}], "id": "CVE-2026-57073", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57073", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-17T12:44:11.342365Z", "version": "2.0.3"}}]}, "published": "2026-07-16T17:16:58.117", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/nanoscopic/perl-HTML-Bare/pull/2"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://security.metacpan.org/patches/H/HTML-Bare/0.02/CVE-2026-57073-r1.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://security.metacpan.org/patches/H/HTML-Bare/0.04/CVE-2026-57073-r2.patch"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/07/16/3"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.04]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "HTML::Bare", "source": "cna", "vendor": "CODECHILD"}, "product": "html::bare", "vendor": "codechild"}], "created": "2026-07-22T20:45:04.793877+00:00", "updated": "2026-07-31T01:45:06.900773+00:00", "vendors": ["codechild", "codechild$PRODUCT$html::bare"]}