CVE-2026-13401 is a high-severity vulnerability in the XML::Bare Perl module (versions <=0.53) where the parserc_parse function can enter an infinite loop when handling malformed XML attributes. Specifically, malformed attributes like nameless attributes (e.g., <a ='c'>) or attributes with unbalanced quotes (e.g., <a b='''''''c'>) cause the parser's state cursor to never advance, leading to a hang condition. This vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition). No official patch or remediation level has been published as of the data provided.

The vulnerability causes a denial of service condition by hanging the XML parser indefinitely when processing certain malformed XML inputs. This can disrupt applications relying on XML::Bare for parsing, potentially leading to service unavailability or resource exhaustion. There is no indication of confidentiality or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or malformed XML inputs that could trigger the infinite loop. Consider implementing input validation or using alternative XML parsing libraries that do not exhibit this behavior.