There are 2 open security issues in bookworm.
2 issues left for the package maintainer to handle:
- CVE-2026-13401:
(postponed; to be fixed through a stable update)
XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. The parserc_parse function never advances the attribute-parse state cursor on certain malformed attribute forms, looping forever. Nameless attributes such as "<a ='c'>" or unbalanced quotes "<a b='''''''c'>" can trigger this condition.
- CVE-2026-57074:
(postponed; to be fixed through a stable update)
XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. The parserc_parse function attempts to check for multicharacter strings such as "<
![[bug history graph]](https://qa.debian.org/data/bts/graphs/libx/libxml-bare-perl.png){kind=link}