Roxmltree
Monthly
Quadratic-time attribute and namespace validation in the Rust XML parsing library roxmltree (versions through 0.21.1) lets remote, unauthenticated attackers cause denial of service by submitting an XML document that places tens of thousands of attributes or namespace declarations on a single element, driving CPU consumption far beyond what the input size would suggest. The vendor-rated CVSS of 8.7 and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that this is a pure availability issue: no confidentiality or integrity impact, no authentication or user interaction required, but exploitation requires the embedding application to parse attacker-controlled XML with roxmltree and to lack its own attribute-count, document-size, or per-request CPU/time limits. No public exploit code was identified at time of analysis, and the library's real-world exposure depends entirely on how the host application wires it in, which is why this is a genuine but bounded availability threat rather than a broadly exploitable one.
Quadratic-time attribute and namespace validation in the Rust XML parsing library roxmltree (versions through 0.21.1) lets remote, unauthenticated attackers cause denial of service by submitting an XML document that places tens of thousands of attributes or namespace declarations on a single element, driving CPU consumption far beyond what the input size would suggest. The vendor-rated CVSS of 8.7 and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) agree that this is a pure availability issue: no confidentiality or integrity impact, no authentication or user interaction required, but exploitation requires the embedding application to parse attacker-controlled XML with roxmltree and to lack its own attribute-count, document-size, or per-request CPU/time limits. No public exploit code was identified at time of analysis, and the library's real-world exposure depends entirely on how the host application wires it in, which is why this is a genuine but bounded availability threat rather than a broadly exploitable one.