Back Linuxsecurity

Fedora 43 perl-XML-Bare Critical Denial of Service Fix CVE-2026

Linuxsecurity •LinuxSecurity Advisories • September 8, 2026

Share: View original

Keep your Linux systems secure and up to date with practical patching guidance. Review Linux Patching Best Practices ×

This module is a 'Bare' XML parser. It is implemented in C. The parser

itself is a simple state engine that is less than 500 lines of C. The

parser builds a C struct tree from input text. That C struct tree is

converted to a Perl hash by a Perl function that makes basic calls back to

the C to go through the nodes sequentially.

XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue. Fixes CVE-2026-57074 and CVE-2026-13401.

* Sun Aug 30 2026 Emmanuel Seyman - 0.53-47 - Include two security fixes for XML-Bare =< 0.53

[ 1 ] Bug #2512103 - CVE-2026-57074 perl-XML-Bare: perl-XML-Bare: Out-of-bounds read via crafted XML input [epel-all] [ 2 ] Bug #2512104 - CVE-2026-57074 perl-XML-Bare: perl-XML-Bare: Out-of-bounds read via crafted XML input [fedora-all] [ 3 ] Bug #2521817 - CVE-2026-13401 perl-XML-Bare: perl-XML-Bare: Denial of Service via malformed XML attributes [fedora-all] [ 4 ] Bug #2521818 - CVE-2026-13401 perl-XML-Bare: perl-XML-Bare: Denial of Service via malformed XML attributes [epel-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-14e358a2a2' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Denial of Service Vulnerability in Fedora's perl-XML-Bare Fedora has released critical updates for the perl-XML-Bare module, addressing vulnerabilities that could lead to Denial of Service (DoS) and infinite loops when parsing malformed XML attributes. The vulnerabilities are identified as CVE-2026-57074 and CVE-2026-13401, both published on July 16, 2026. Affected versions are perl-XML-Bare versions up to 0.53. The updates were made available on August 30, 2026, and users are urged to apply the patches using the 'dnf' update program. The vulnerabilities could be exploited through crafted XML input, potentially affecting systems relying on this parser. The patches are crucial for maintaining system security and preventing service disruptions. 2 sources 58

Extracted Entities

Fedora 43 perl-XML-Bare Critical Denial of Service Fix CVE-2026

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (1)