An unauthenticated denial of service vulnerability in the CODECHILD XML::Bare Perl module allows attackers to hang applications by submitting specifically malformed XML input.

The parserc_parse function fails to advance the state cursor when processing malformed attributes, such as nameless attributes or unbalanced quotes. This logic error triggers an infinite loop, consuming CPU resources and resulting in a denial of service.

Successful exploitation leads to a complete hang of the application utilizing the vulnerable module, causing service downtime. Given the CVSS score of 7.5, this is a high-severity risk for any public-facing web service or application that parses untrusted XML using this library. The vulnerability is easily triggered without authentication, making it an attractive target for automated denial of service attacks.

Immediate Action: Update the CODECHILD XML::Bare module to a version newer than 0.53.

Proactive Monitoring: Monitor server CPU utilization and error logs for application hangs or recurring parsing errors that may indicate an exploitation attempt.

Compensating Controls: Implement strict XML schema validation or a Web Application Firewall (WAF) to reject malformed XML input before it reaches the vulnerable parsing component.

Public Exploit Available: No confirmed public exploit available.

Service availability is at risk if this module is utilized in any externally accessible application. Organizations should verify their dependencies and update to a patched version immediately to ensure resilience against denial of service attacks.