Denial of Service Vulnerability in roxmltree

The roxmltree library (versions 0.21.1 and earlier) is susceptible to a denial of service vulnerability triggered by inefficient attribute and namespace validation during XML parsing. The implementation lacks sufficient limits on the number of attributes processed for a single XML element, resulting in quadratic-time complexity. An unauthenticated attacker can exploit this by submitting a specially crafted XML payload containing an extremely large number of attributes on a single node. When the application parses this malicious document, the CPU utilization spikes to maximum capacity, rendering the service unresponsive. This vulnerability poses a significant risk to any application that uses roxmltree to process user-supplied XML data without external validation or input size constraints.

Impact

Successful exploitation results in service unavailability via resource exhaustion, specifically targeting the CPU. This impacts any environment utilizing affected versions of the roxmltree library for XML parsing, particularly internet-facing services that accept arbitrary XML input.

Recommendation

• Upgrade the roxmltree library to a version containing the fix for CVE-2026-92987.
• Implement input validation on the application layer to restrict the maximum number of attributes allowed per XML element before passing the data to the parser.
• Monitor application logs and system performance metrics for sudden spikes in CPU utilization originating from service processes responsible for handling XML input.