Most recent entries from all

certfr-2023-avi-0705 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2023-avi-0705

EUVD-2026-8690

fkie_cve-2023-34104

fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for denial of service (DoS) attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. This problem has been resolved in v4.2.4. Users are advised to upgrade. Users unable to upgrade should avoid using DOCTYPE parsing by setting the `processEntities: false` option.

GHSA-6w63-h3fj-q4vw — fast-xml-parser vulnerable to Regex Injection via Doctype Entities

Affected: npm: fast-xml-parser

### Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.

### Patches The problem has been resolved in v4.2.4

### Workarounds Avoid using DOCTYPE parsing by `processEntities: false` option.

gsd-2023-34104

RHSA-2023:4627 — Red Hat Security Advisory: Migration Toolkit for Applications security and bug fix update

jackson-databind: Possible DoS if using JDK serialization to serialize JsonNode undertow: Server identity in https connection is not checked by the undertow client x/net/http2/h2c: request smuggling golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption dev-java/snakeyaml: DoS via stack overflow codec-haproxy: HAProxyMessageDecoder Stack Exhaustion DoS htmlUnit: Stack overflow crash causes Denial of Service (DoS) zip4j: does not always check the MAC when decrypting a ZIP archive golang: crypto/internal/nistec: specific unreduced P-256 scalars produce incorrect results golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: go/parser: Infinite loop in parsing golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang-github-gin-gonic-gin: Improper Input Validation golang: html/template: improper handling of empty HTML attributes fast-xml-parser: Regex Injection via Doctype Entities