Bug#1142227: libxml-bare-perl: CVE-2026-13401 CVE-2026-57074

[Salvatore Bonaccorso]

Source: libxml-bare-perl
Version: 0.53-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
Control: found -1 0.53-2
Control: found -1 0.53-1

Hi,

The following vulnerabilities were published for libxml-bare-perl.

CVE-2026-13401[0]:
| XML::Bare versions through 0.53 for Perl will hang in an infinite
| loop when parsing malformed attributes.  The parserc_parse function
| never advances the attribute-parse state cursor on certain malformed
| attribute forms, looping forever.  Nameless attributes such as "<a
| ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this
| condition.


CVE-2026-57074[1]:
| XML::Bare versions through 0.53 for Perl have an unbounded character
| lookahead.  The parserc_parse function attempts to check for
| multicharacter strings such as "<![CDATA" or element terminators
| such as ">" without checking that the offsets are within the buffer.
| Truncated strings such as "<a/" can trigger an out-of-bounds read.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-13401
    https://www.cve.org/CVERecord?id=CVE-2026-13401
[1] https://security-tracker.debian.org/tracker/CVE-2026-57074
    https://www.cve.org/CVERecord?id=CVE-2026-57074

Regards,
Salvatore