01 Record

CVE-2026-13051

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template

CriticalPUBLISHEDCNA: CPANSec

Base score9.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

View raw JSON CVE Program record

02 Description

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add_error as a Locale::Maketext template

03 Metadata

Published: 2026-08-13 16:28Z1 DAY AGO
Last updated: 2026-08-14 17:47Z57 MIN AGO
Reserved: 2026-06-23
Assigning CNA: CPANSec
Record state: PUBLISHED
Severity: Critical (CVSS 9.1)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses: CWE-470 CWE-1336
SSVC decision: ExploitationnoneAutomatableyesTechnical Impacttotal
Data version: 5.2
Document digest: 675d4d65d751f14f37352a4515182c219b1a1bff32a5dd9fe385c951652deab0

04 Affected products

No products listed

This record names no affected vendor or product. That is common for reserved identifiers and for records whose CNA published only a narrative description.

05 References

security.metacpan.orghttps://security.metacpan.org/patches/F/Form-Processor/1.162360/CVE-2026-13051-r1.patchpatch
metacpan.orghttps://metacpan.org/release/HANK/Form-Processor-1.162360/source/lib/Form/Processor/Field/HtmlArea.pm#L28-31
metacpan.orghttps://metacpan.org/release/HANK/Form-Processor-1.162360/source/lib/Form/Processor/Field.pm#L163
www.cve.orghttps://www.cve.org/CVERecord?id=CVE-2012-6329related