CVE-2026-92987
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service.
वीकनेस
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service.
संदर्भ
- https://github.com/RazrFalcon/roxmltree
- https://github.com/RazrFalcon/roxmltree/blob/v0.21.1/src/lib.rs#L751-L755
- https://github.com/RazrFalcon/roxmltree/blob/v0.21.1/src/parse.rs#L1014-L1020
- https://github.com/RazrFalcon/roxmltree/issues/153
- https://www.vulncheck.com/advisories/roxmltree-through-0.21.1-denial-of-service-via-quadratic-parsing
हमलावर से पहले बग आप ढूँढें।
GitHub से साइन इन करें और एक मिनट से भी कम में अपना पहला ऑडिट चलाएँ। फ़्री प्लान के लिए क्रेडिट कार्ड की ज़रूरत नहीं।