roxmltree CVE-2026-92987

Exploitation requires that the target application parse attacker-supplied XML using roxmltree at or below version 0.21.1 and that no upstream limit caps attribute count or per-request CPU/time. The malicious input is a single element carrying tens of thousands of attributes (or namespace declarations), which drives the quadratic validation path in parse.rs. No authentication, no user interaction, and no special product configuration are needed (PR:N/UI:N). Limiting factors that reduce real-world risk: applications that never accept untrusted XML, that enforce request-size/attribute caps or WAF limits, or that run parsing in a bounded/isolated worker are effectively shielded; the flaw is in the library, so exposure hinges on how the embedding application wires it in.

This is a genuine availability threat but a bounded one. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 8.7 (High) and is internally consistent: an unauthenticated, network-reachable, low-complexity denial-of-service with a single-impact profile (VA:H only; VC:N/VI:N - no confidentiality or integrity loss and no scope change). CWE-407 (algorithmic complexity) matches the description precisely: quadratic-time attribute/namespace validation triggered by a high attribute count. The 8.7 is driven almost entirely by ease of reach, not by impact breadth - this is a resource-exhaustion bug, not a memory-safety or RCE issue (roxmltree is safe Rust and read-only). No EPSS score, no CISA KEV listing, and no explicitly published exploit are present in the input, so there is no evidence of active exploitation; however, the public GitHub issue (#153) and pinpoint source references (parse.rs L1014-1020, lib.rs L751-755) make a proof-of-concept trivial to reproduce. Realistic priority is moderate: patch it where roxmltree parses untrusted XML on a request path, but it is not a drop-everything emergency. Key caveat - actual exploitability depends entirely on whether the embedding application feeds attacker-controlled XML to the parser and whether it enforces upstream size limits; the CVE describes the library defect, not any specific deployed exposure.

An attacker submits a small XML document (tens of KB) containing a single element bearing tens of thousands of attributes to any endpoint that parses XML with roxmltree. The quadratic validation loop consumes disproportionate CPU per request, so a handful of concurrent submissions can saturate a worker/thread and stall or crash the service. No authentication or user interaction is required; a working PoC is easy to build from the referenced GitHub issue and source lines, though no weaponized exploit is confirmed in the wild.