The XML::Bare parser enters an infinite loop when it encounters certain malformed attribute forms, such as nameless attributes or unbalanced quotes. The failure to advance the parsing cursor leads to a denial‑of‑service condition, effectively hanging the process that invoked the parser. This flaw is classified as CWE‑835, illustrating a loop error that compromises reliability.

Perl applications that use CODECHILD XML::Bare library versions 0.53 and earlier are vulnerable. Any deployment that imports XML data using these versions must be addressed.

While the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, the infinite‑loop behavior represents a moderate‑to‑high‑risk denial‑of‑service issue. The CVSS score of 7.5 indicates high severity. An attacker who can supply malformed XML—whether through a web request, Email, or any other data channel—can trigger the crash, halting the affected service. The attack vector is inferred to be remote exploitation via crafted XML input to vulnerable applications.