Description
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
RazrFalcon roxmltree
Default version status: unaffected
0 to ≤ 0.21.1affected
pkg:cargo/roxmltreeReferences
- https://github.com/RazrFalcon/roxmltree/issues/153 ↗
- https://github.com/RazrFalcon/roxmltree ↗
- https://github.com/RazrFalcon/roxmltree/blob/v0.21.1/src/parse.rs#L1014-L1020 ↗
- https://github.com/RazrFalcon/roxmltree/blob/v0.21.1/src/lib.rs#L751-L755 ↗
- https://www.vulncheck.com/advisories/roxmltree-through-0.21.1-denial-of-service-via-quadratic-parsing ↗