{"id":"CVE-2026-41673","state":"PUBLISHED","title":"xmldom: Denial of service via uncontrolled recursion in XML serialization","description":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.","publishedAt":"2026-05-07T03:40:28.378Z","updatedAt":"2026-08-28T12:04:19.816Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["xmldom xmldom"],"affected":[{"vendor":"xmldom","product":"xmldom","versions":[{"version":"xmldom <= 0.6.0","status":"affected"},{"version":"@xmldom/xmldom >= 0.9.0, < 0.9.10","status":"affected"},{"version":"@xmldom/xmldom < 0.8.13","status":"affected"}]}],"references":["https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa","https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597","https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f","https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a","https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe","https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3","https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112","https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb","https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84","https://github.com/xmldom/xmldom/releases/tag/0.8.13","https://github.com/xmldom/xmldom/releases/tag/0.9.10","https://access.redhat.com/security/cve/CVE-2026-41673","https://bugzilla.redhat.com/show_bug.cgi?id=2467630","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41673.json","https://access.redhat.com/errata/RHSA-2026:26234","https://access.redhat.com/errata/RHSA-2026:60520"],"weaknesses":["CWE-674","CWE-776"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/41xxx/CVE-2026-41673.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-41673","state":"PUBLISHED","datePublished":"2026-05-07T03:40:28.378Z","dateUpdated":"2026-08-28T12:04:19.816Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-04-22T03:53:24.405Z"},"containers":{"cna":{"title":"xmldom: Denial of service via uncontrolled recursion in XML serialization","descriptions":[{"lang":"en","value":"xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13."}],"affected":[{"vendor":"xmldom","product":"xmldom","versions":[{"version":"xmldom <= 0.6.0","status":"affected"},{"version":"@xmldom/xmldom >= 0.9.0, < 0.9.10","status":"affected"},{"version":"@xmldom/xmldom < 0.8.13","status":"affected"}]}],"references":[{"url":"https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","name":"https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa","name":"https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597","name":"https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f","name":"https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a","name":"https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe","name":"https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3","name":"https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112","name":"https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb","name":"https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84","name":"https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/releases/tag/0.8.13","name":"https://github.com/xmldom/xmldom/releases/tag/0.8.13","tags":["x_refsource_MISC"]},{"url":"https://github.com/xmldom/xmldom/releases/tag/0.9.10","name":"https://github.com/xmldom/xmldom/releases/tag/0.9.10","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":8.7,"baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-674","lang":"en","description":"CWE-674: Uncontrolled Recursion","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-05-07T03:40:28.378Z"},"source":{"advisory":"GHSA-2v35-w6hq-6mfw","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-07T14:08:40.798873Z","id":"CVE-2026-41673","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-07T14:10:45.986Z"}},{"title":"@xmldom/xmldom: xmldom: xmldom: Denial of Service via deeply nested XML documents","descriptions":[{"lang":"en","value":"A flaw was found in the `xmldom` library, a JavaScript module for parsing XML documents. An attacker could exploit this vulnerability by providing a specially crafted, deeply nested XML document. This could lead to a Denial of Service (DoS) by causing the application to crash due to excessive recursion."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Developer Hub 1.9","packageName":"rhdh/rhdh-hub-rhel9","defaultStatus":"affected","versions":[{"version":"1781187342","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:rhdh:1.9::el9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","packageName":"rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9","defaultStatus":"affected","versions":[{"version":"1787121387","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift_ai:3.4::el9"]},{"vendor":"Red Hat","product":"Red Hat Build of Podman Desktop","packageName":"rh-podman-desktop.git","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:podman_desktop:1"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"grafana","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Fuse 7","packageName":"xmldom","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_fuse:7"]},{"vendor":"Red Hat","product":"Red Hat OpenShift AI (RHOAI)","packageName":"rhoai/odh-mlflow-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_ai"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-agent-installer-ui-rhel9","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"openshift4/ose-console","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]},{"vendor":"Red Hat","product":"Self-service automation portal 2","packageName":"ansible-automation-platform/automation-portal","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_portal:2"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-41673","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2467630","name":"RHBZ#2467630","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41673.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26234","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60520","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-776","description":"Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-08-28T12:04:19.816Z"},"datePublic":"2026-05-07T03:40:28.378Z","solutions":[{"lang":"en","value":"RHSA-2026:26234: Red Hat Developer Hub 1.9"},{"lang":"en","value":"RHSA-2026:60520: Red Hat OpenShift AI 3.4"}],"timeline":[{"lang":"en","time":"2026-05-07T05:02:01.500Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-05-07T03:40:28.378Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}