A memory leak exists in all releases of CSS::Minifier::XS before 0.14 for Perl. The minify routine repeatedly allocates memory when processing content that ultimately removes all characters, such as a file consisting only of comments and whitespace. Because the leaked memory is never freed, repeated calls can drain system memory and cause the host process or entire system to become unresponsive. The weakness is classified as CWE-401.

The affected product is CSS::Minifier::XS, a Perl library developed by GTERMARS. Versions prior to the 0.14 release are vulnerable. Any Perl application, web service, or automated build system that imports this library to minify CSS and accepts unfiltered user input could be at risk.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 indicates a moderate severity. The attack requires the execution of code that uses the vulnerable library, which is typically supplied by unfiltered CSS input from an external source. Based on the description, the likely attack vector is remote exploitation via user‑submitted CSS, though local code execution would also be effective. The risk level is moderate to high because a maliciously crafted CSS document can exhaust memory and trigger a denial of service.