https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:07:22 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352286 EUVD-2026-352286 https://cve.radiocsirt.org/vuln/euvd-2026-352286 https://cve.radiocsirt.org/vuln/fkie_cve-2026-73569 <p>fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration&#39;s entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.</p> <p>fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration&#39;s entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-73569 https://cve.radiocsirt.org/vuln/ghsa-8r6m-32jq-jx6q <p><strong>Affected:</strong> npm: fast-xml-parser</p> <p>### Impact `fast-xml-parser` processes multiple &#34;DOCTYPE&#34; declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`.</p> <p>`addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.</p> <p>This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.</p> <p>### Workarounds - Manually check if multiple DOCTYPEs are not present in input contents - Update to v5.10.1 - Keep `processEntity` flag off</p> <p><strong>Affected:</strong> npm: fast-xml-parser</p> <p>### Impact `fast-xml-parser` processes multiple &#34;DOCTYPE&#34; declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`.</p> <p>`addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.</p> <p>This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.</p> <p>### Workarounds - Manually check if multiple DOCTYPEs are not present in input contents - Update to v5.10.1 - Keep `processEntity` flag off</p> https://cve.radiocsirt.org/vuln/ghsa-8r6m-32jq-jx6q https://cve.radiocsirt.org/vuln/rhsa-2026:65130 <p>fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input fast-xml-parser: fast-xml-parser: Denial of Service via repeated DOCTYPE declarations</p> <p>fast-uri: Fast-uri: Security policy bypass due to URL parsing inconsistency github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input fast-xml-parser: fast-xml-parser: Denial of Service via repeated DOCTYPE declarations</p> https://cve.radiocsirt.org/vuln/rhsa-2026:65130 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-73569 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-webfont, Ubuntu:26.04:LTS: node-webfont</p> <p>fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration&#39;s entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-webfont, Ubuntu:26.04:LTS: node-webfont</p> <p>fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration&#39;s entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-73569 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3448 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3448