CVE-2026-13593 CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away
A memory leak in the Perl CSS::Minifier::XS library allows attackers to cause denial of service by submitting documents consisting solely of removable characters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13593?
CVE-2026-13593 is a medium-severity denial of service vulnerability in GTERMARS CSS::Minifier::XS, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away.
The minify function has a memory leak when processing a document containing only characters to be removed, such as comments and whitespace.
Weakness: CWE-401
Which versions are affected by CVE-2026-13593?
Linux distribution packages (1)
perl-CSS-Minifier-XS openSUSE:Tumbleweed | All versions | 0.140.0-1.1 |
How do I fix CVE-2026-13593?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-13593 being exploited?
There is no known exploitation of CVE-2026-13593 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-13593, DEBIAN-CVE-2026-13593, GHSA-89gv-4m9m-97p2, MGASA-2026-0267, UBUNTU-CVE-2026-13593, openSUSE-SU-2026:11157-1.