Executive brief
roxmltree is a Rust library for parsing and representing XML documents. A denial-of-service vulnerability allows attackers to craft XML files with extremely large numbers of attributes on a single element, causing the parser to consume excessive CPU time and potentially crash or hang applications that use this library.
Technical details
The vulnerability is a algorithmic complexity issue (ReDoS / algorithmic DoS) in the attribute and namespace validation logic during XML parsing. The parser performs quadratic-time validation operations on element attributes without enforcing any limit on attribute count. An attacker can construct a malicious XML document with tens of thousands of attributes on a single element to trigger worst-case behavior, causing excessive CPU consumption. The attack requires only network access to provide the malicious XML file to an application using roxmltree, and no authentication or user interaction is needed. The impact is denial of service through resource exhaustion. A patch is expected to address this by implementing attribute count limits or optimizing the validation algorithm.
Affected products
- RazrFalcon roxmltree through 0.21.1
Timeline
- 2026-09-17: disclosed