CVE-2026-13593: CSS::Minifier::XS Perl DoS Vulnerability

CVE-2026-13593 Overview

CVE-2026-13593 is a memory leak vulnerability in the CSS::Minifier::XS Perl module versions before 0.14. The flaw resides in the minify function, which fails to release allocated memory when processing CSS documents that contain only removable content such as comments and whitespace. When the entire document is minified away, the leaked memory accumulates in the host process. Repeated invocations against attacker-controlled input can exhaust available memory over time. The issue is tracked under CWE-401: Missing Release of Memory after Effective Lifetime.

Critical Impact
Remote attackers can trigger progressive memory exhaustion in long-running Perl services that use CSS::Minifier::XS to process untrusted CSS input.

Affected Products

CSS::Minifier::XS Perl module versions prior to 0.14
Perl applications and web services that invoke the minify function on untrusted CSS input
Build pipelines and asset processors that embed the vulnerable module

Discovery Timeline

2026-06-29 - CVE-2026-13593 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13593

Vulnerability Analysis

The vulnerability lives in the minify function exposed by CSS::Minifier::XS, an XS-backed Perl module written in C for performance. When callers pass CSS input consisting entirely of tokens that the minifier removes, such as comments (/* ... */) and whitespace, the function returns an empty result but does not free intermediate buffers allocated during tokenization. Each invocation leaks a bounded amount of heap memory. In short-lived scripts the leak is inconsequential, but web servers, job queues, and daemons that call minify repeatedly accumulate leaked allocations across requests. Attackers who can submit CSS content to a service using this module can drive the worker process toward memory exhaustion without triggering typical crash signals.

Root Cause

The root cause is [CWE-401]: the XS layer allocates working buffers for the tokenizer and output but omits the corresponding free path in the code path that handles a fully-eliminated document. Because the return value is an empty string, cleanup logic that keys off the presence of output tokens is skipped. Version 0.14 corrects the cleanup path so that all allocations are released regardless of whether the minified output is empty.

Attack Vector

Exploitation requires only the ability to supply CSS input to an application that calls minify. This is common in web-facing asset preprocessors, user-content sanitizers, and CMS plugins that accept CSS from users or themes. An attacker sends repeated requests containing CSS payloads composed entirely of comments and whitespace. Each request leaks memory in the worker process. Over time the process consumes available memory, degrades service, and can force the operating system to kill or restart the worker. The vulnerability does not permit code execution or data disclosure.

See the MetaCPAN release notes for CSS-Minifier-XS 0.14 and the Openwall OSS-Security disclosure for upstream details.

Detection Methods for CVE-2026-13593

Indicators of Compromise

Steady growth of resident set size (RSS) in Perl worker processes that handle CSS input
Repeated HTTP requests carrying CSS bodies containing only comments and whitespace
Out-of-memory (OOM) kills of Perl workers logged by systemd, the kernel, or process supervisors
Elevated request rates to endpoints that expose CSS minification functionality

Detection Strategies

Inventory Perl environments and identify installations of CSS::Minifier::XS below version 0.14 using cpanm --info or perl -MCSS::Minifier::XS -e 'print $CSS::Minifier::XS::VERSION'
Instrument applications with memory profilers such as Devel::MAT or Devel::Leak to correlate leak growth with minify calls
Add request-body inspection rules in web application firewalls to flag CSS payloads that contain only comment and whitespace tokens

Monitoring Recommendations

Alert on sustained RSS growth in worker processes that never returns to baseline after request completion
Track OOM kill events and correlate with request logs for endpoints that invoke CSS::Minifier::XS
Monitor CPAN dependency manifests in CI pipelines and fail builds pinned to versions below 0.14

How to Mitigate CVE-2026-13593

Immediate Actions Required

Upgrade CSS::Minifier::XS to version 0.14 or later on all systems running Perl applications that process CSS
Restart long-running Perl worker processes after the upgrade to reclaim already-leaked memory
Rebuild and redeploy container images and application bundles that vendor the vulnerable version

Patch Information

The fix is available in CSS::Minifier::XS version 0.14, published on CPAN. Install using cpanm CSS::Minifier::XS@0.14 or the equivalent command for your Perl package manager. Refer to the MetaCPAN release changes page for the full changelog.

Workarounds

Configure process supervisors to recycle Perl workers after a bounded number of requests to cap leak accumulation
Reject or short-circuit CSS inputs that contain no declarations before passing them to minify
Impose per-client rate limits on endpoints that expose CSS minification to untrusted callers

bash

# Upgrade the vulnerable module to the fixed release
cpanm CSS::Minifier::XS@0.14

# Verify the installed version
perl -MCSS::Minifier::XS -e 'print $CSS::Minifier::XS::VERSION, "\n"'