CVE-2026-57074

Name of the Vulnerable Software and Affected Versions XML::Bare versions prior to 0.53

Description The parserc parse() function contains an unbounded character lookahead. The parser attempts to verify multicharacter strings, such as "<![CDATA" or element terminators like ">", without validating that the offsets remain within the buffer boundaries. Consequently, truncated strings, such as "<a/", can trigger an out-of-bounds read, which occurs when the software reads data past the end of the intended buffer.

Recommendations Update to version 0.53 or later.