Index: src/OFXMLParser.h
==================================================================
--- src/OFXMLParser.h
+++ src/OFXMLParser.h
@@ -139,12 +139,11 @@
 		OF_XMLPARSER_IN_ATTR_VALUE,
 		OF_XMLPARSER_EXPECT_CLOSE,
 		OF_XMLPARSER_EXPECT_SPACE_OR_CLOSE,
 		OF_XMLPARSER_IN_EXCLAMATIONMARK,
 		OF_XMLPARSER_IN_CDATA_OPENING,
-		OF_XMLPARSER_IN_CDATA_1,
-		OF_XMLPARSER_IN_CDATA_2,
+		OF_XMLPARSER_IN_CDATA,
 		OF_XMLPARSER_IN_COMMENT_OPENING,
 		OF_XMLPARSER_IN_COMMENT_1,
 		OF_XMLPARSER_IN_COMMENT_2,
 		OF_XMLPARSER_IN_DOCTYPE,
 		OF_XMLPARSER_NUM_STATES

Index: src/OFXMLParser.m
==================================================================
--- src/OFXMLParser.m
+++ src/OFXMLParser.m
@@ -152,12 +152,11 @@
 		@selector(OF_inAttributeValueState),
 		@selector(OF_expectCloseState),
 		@selector(OF_expectSpaceOrCloseState),
 		@selector(OF_inExclamationMarkState),
 		@selector(OF_inCDATAOpeningState),
-		@selector(OF_inCDATAState1),
-		@selector(OF_inCDATAState2),
+		@selector(OF_inCDATAState),
 		@selector(OF_inCommentOpeningState),
 		@selector(OF_inCommentState1),
 		@selector(OF_inCommentState2),
 		@selector(OF_inDOCTYPEState)
 	};
@@ -912,55 +911,42 @@
 {
 	if (_data[_i] != "CDATA["[_level])
 		@throw [OFMalformedXMLException exceptionWithParser: self];
 
 	if (++_level == 6) {
-		_state = OF_XMLPARSER_IN_CDATA_1;
+		_state = OF_XMLPARSER_IN_CDATA;
 		_level = 0;
 	}
 
 	_last = _i + 1;
 }
 
-- (void)OF_inCDATAState1
+- (void)OF_inCDATAState
 {
+
 	if (_data[_i] == ']')
 		_level++;
-	else
-		_level = 0;
-
-	if (_level == 2)
-		_state = OF_XMLPARSER_IN_CDATA_2;
-}
-
-- (void)OF_inCDATAState2
-{
-	void *pool;
-	OFString *CDATA;
-
-	if (_data[_i] != '>') {
-		_state = OF_XMLPARSER_IN_CDATA_1;
-		_level = (_data[_i] == ']' ? 1 : 0);
-
-		return;
-	}
-
-	pool = objc_autoreleasePoolPush();
-
-	buffer_append(_buffer, _data + _last, _encoding, _i - _last);
-	CDATA = transform_string(_buffer, 2, false, nil);
-
-	if ([_delegate respondsToSelector: @selector(parser:foundCDATA:)])
-		[_delegate parser: self
-		       foundCDATA: CDATA];
-
-	objc_autoreleasePoolPop(pool);
-
-	[_buffer removeAllItems];
-
-	_last = _i + 1;
-	_state = OF_XMLPARSER_OUTSIDE_TAG;
+	else if (_data[_i] == '>' && _level >= 2) {
+		void *pool = objc_autoreleasePoolPush();
+		OFString *CDATA;
+
+		buffer_append(_buffer, _data + _last, _encoding, _i - _last);
+		CDATA = transform_string(_buffer, 2, false, nil);
+
+		if ([_delegate respondsToSelector:
+		    @selector(parser:foundCDATA:)])
+			[_delegate parser: self
+			       foundCDATA: CDATA];
+
+		objc_autoreleasePoolPop(pool);
+
+		[_buffer removeAllItems];
+
+		_last = _i + 1;
+		_state = OF_XMLPARSER_OUTSIDE_TAG;
+	} else
+		_level = 0;
 }
 
 /* Comment */
 - (void)OF_inCommentOpeningState
 {

Index: tests/OFXMLParserTests.m
==================================================================
--- tests/OFXMLParserTests.m
+++ tests/OFXMLParserTests.m
@@ -69,11 +69,11 @@
 		break;
 	case 4:
 		TEST(msg, et == STRING && [string isEqual: @"\n\n "])
 		break;
 	case 5:
-		TEST(msg, et == CDATA && [string isEqual: @"f<]]]oo"] &&
+		TEST(msg, et == CDATA && [string isEqual: @"f<]]]oo]"] &&
 		    [parser lineNumber] == 3)
 		break;
 	case 6:
 		TEST(msg, et == TAG_START && [name isEqual: @"bar"] &&
 		    prefix == nil && ns == nil && attrs == nil)
@@ -323,11 +323,11 @@
 - (void)XMLParserTests
 {
 	OFAutoreleasePool *pool = [[OFAutoreleasePool alloc] init];
 	const char *str = "\xEF\xBB\xBF<?xml version='1.0'?><?p?i?>"
 	    "<!DOCTYPE foo><root>\r\r"
-	    " <![CDATA[f<]]]oo]]><bar/>\n"
+	    " <![CDATA[f<]]]oo]]]><bar/>\n"
 	    " <foobar xmlns='urn:objfw:test:foobar'>\r\n"
 	    "  <qux xmlns:foo='urn:objfw:test:foo'>\n"
 	    "   <foo:bla foo:bla = '&#x62;&#x6c;&#x61;' blafoo='foo'>\n"
 	    "    <blup foo:qux='asd' quxqux='test'/>\n"
 	    "    <bla:bla\r\rxmlns:bla\r=\t\"urn:objfw:test:bla\" qux='qux'\r\n"