CVE-2026-13401

Name of the Vulnerable Software and Affected Versions XML::Bare versions prior to 0.53

Description The software may enter an infinite loop when parsing malformed attributes. This occurs because the c parse() function fails to advance the attribute-parse state cursor when encountering specific malformed attribute forms, such as nameless attributes (e.g., "<a ='c'>") or unbalanced quotes (e.g., "<a b=''''''c'>").

Recommendations Update to version 0.53 or later.