The vulnerability is a resource exhaustion flaw in the HTML::Bare parser_c_parse function, identified as CWE‑835. When encountering certain malformed attribute forms—such as nameless attributes (e.g., "<a ='c'>") or unbalanced quotes (e.g., "<a b='''''''c'>")—the parser fails to advance its internal cursor and loops forever. This infinite loop effectively stalls the parsing operation, causing the application to become unresponsive and leading to a denial of service. Since the flaw resides in the core parsing engine, the input HTML can trigger the crash by injecting malicious attributes, potentially through any interface that feeds untrusted HTML into the module.

Perl modules HTML::Bare version 0.04 and earlier are affected. The latest CPAN release at the time of reporting is 0.02, but newer development builds are available in the module’s source repository. Systems that install or use these versions of HTML::Bare—particularly those exposing user-supplied HTML content—are at risk.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of <1% suggests exploitation probability is very low at present. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker could deliver malicious attribute strings—such as nameless or unbalanced quotes—to cause the infinite loop. This attack could be executed via any interface that processes untrusted HTML input, potentially leading to denial of service. Because the flaw resides in the parsing engine, remediation requires a code patch rather than runtime configuration.