CVE-2026-13397: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in CODECHILD HTML::Bare
HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition. Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.
AI Analysis
Technical Summary
CVE-2026-13397 is a vulnerability in the CODECHILD HTML::Bare Perl module (versions <=0.04) where the parserc_parse function can enter an infinite loop when encountering malformed HTML attributes. Specifically, malformed inputs like nameless attributes (e.g., <a ='c'>) or unbalanced quotes (e.g., <a b='''''''c'>) cause the parser to never advance its attribute-parse state cursor, resulting in a hang condition. This is classified under CWE-835 (Loop with Unreachable Exit Condition). The latest CPAN version is 0.02, with newer versions available only in the git repository. No CVSS score or official remediation is currently documented.
Potential Impact
Affected versions of HTML::Bare will hang indefinitely when parsing certain malformed HTML attributes, causing denial of service conditions in applications using this module. There is no indication of code execution or data corruption beyond the infinite loop hang.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory or git repository for updated versions that address this issue. Until a fix is available, avoid parsing untrusted or malformed HTML inputs that could trigger the infinite loop condition.
CVE-2026-13397: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') in CODECHILD HTML::Bare
Description
HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition. Note that the latest version available on CPAN is version 0.02. Newer versions are available on the git repository.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-13397 is a vulnerability in the CODECHILD HTML::Bare Perl module (versions <=0.04) where the parserc_parse function can enter an infinite loop when encountering malformed HTML attributes. Specifically, malformed inputs like nameless attributes (e.g., <a ='c'>) or unbalanced quotes (e.g., <a b='''''''c'>) cause the parser to never advance its attribute-parse state cursor, resulting in a hang condition. This is classified under CWE-835 (Loop with Unreachable Exit Condition). The latest CPAN version is 0.02, with newer versions available only in the git repository. No CVSS score or official remediation is currently documented.
Potential Impact
Affected versions of HTML::Bare will hang indefinitely when parsing certain malformed HTML attributes, causing denial of service conditions in applications using this module. There is no indication of code execution or data corruption beyond the infinite loop hang.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory or git repository for updated versions that address this issue. Until a fix is available, avoid parsing untrusted or malformed HTML inputs that could trigger the infinite loop condition.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CPANSec
- Date Reserved
- 2026-06-26T08:25:15.552Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a5907ce68715ace4356ca5c
Added to database: 07/16/2026, 16:33:18 UTC
Last enriched: 07/16/2026, 16:49:21 UTC
Last updated: 07/17/2026, 03:38:32 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.