{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/fast-xml-parser--5.9.3--5.10.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["fast-xml-parser (\u003e= 5.9.3, \u003c 5.10.1)"],"_cs_severities":["medium"],"_cs_tags":["denial-of-service","vulnerability-exploitation","software-supply-chain"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA critical vulnerability (tracked as GHSA-8r6m-32jq-jx6q) in the \u003ccode\u003efast-xml-parser\u003c/code\u003e library, versions greater than or equal to 5.9.3 and less than 5.10.1, allows attackers to trigger a denial of service (DoS) by crafting malicious XML documents. The library improperly handles multiple \u003ccode\u003eDOCTYPE\u003c/code\u003e declarations within a single XML document. Each \u003ccode\u003eDOCTYPE\u003c/code\u003e declaration processes its entities through \u003ccode\u003e@nodable/entities\u003c/code\u003e' \u003ccode\u003eaddInputEntities()\u003c/code\u003e function, which unexpectedly resets the entity expansion counters (\u003ccode\u003emaxTotalExpansions\u003c/code\u003e and \u003ccode\u003emaxExpandedLength\u003c/code\u003e) each time it is called. This design flaw enables an attacker to repeatedly reset these limits, allowing a crafted XML document to consume excessive system resources, leading to high CPU utilization, event-loop blocking, severe memory exhaustion, and ultimately process termination. This vulnerability has been present in affected versions since 5.9.3 and impacts any application or service utilizing the vulnerable \u003ccode\u003efast-xml-parser\u003c/code\u003e library.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious XML document containing multiple \u003ccode\u003eDOCTYPE\u003c/code\u003e declarations.\u003c/li\u003e\n\u003cli\u003eThe crafted XML document is supplied as input to a system or application utilizing the vulnerable \u003ccode\u003efast-xml-parser\u003c/code\u003e library (versions \u0026gt;= 5.9.3, \u0026lt; 5.10.1).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003efast-xml-parser\u003c/code\u003e library begins parsing the XML document.\u003c/li\u003e\n\u003cli\u003eUpon encountering each \u003ccode\u003eDOCTYPE\u003c/code\u003e declaration, the parser passes its entities to the \u003ccode\u003e@nodable/entities\u003c/code\u003e library, which calls \u003ccode\u003eaddInputEntities()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eaddInputEntities()\u003c/code\u003e function, when called multiple times, unexpectedly resets internal entity expansion counters (e.g., \u003ccode\u003emaxTotalExpansions\u003c/code\u003e, \u003ccode\u003emaxExpandedLength\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eDue to the repeated resets, the attacker's crafted XML document can exceed the configured entity-expansion limits that would normally prevent resource exhaustion.\u003c/li\u003e\n\u003cli\u003eThe parsing process consumes excessive CPU cycles and memory.\u003c/li\u003e\n\u003cli\u003eThe host system experiences event-loop blocking, memory exhaustion, and eventually the application process terminates, resulting in a denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability leads to a denial of service (DoS) condition on the affected system or application. An attacker can cause excessive CPU utilization, block the event loop, exhaust available memory, and force the termination of the parsing process or the entire application. This can lead to significant service disruptions, system instability, and potential data loss if the application cannot recover gracefully. While specific victim counts are not available, any organization using vulnerable versions of \u003ccode\u003efast-xml-parser\u003c/code\u003e in their web applications, APIs, or backend services is susceptible to this attack, with potential impact on critical business operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003efast-xml-parser\u003c/code\u003e to version 5.10.1 or later to patch the vulnerability.\u003c/li\u003e\n\u003cli\u003eManually implement input validation to check for and reject XML documents containing multiple \u003ccode\u003eDOCTYPE\u003c/code\u003e declarations, especially if immediate patching is not possible.\u003c/li\u003e\n\u003cli\u003eEnsure the \u003ccode\u003eprocessEntity\u003c/code\u003e flag in \u003ccode\u003efast-xml-parser\u003c/code\u003e configurations is kept off (default behavior) to reduce exposure, though this is not a complete mitigation for this specific vulnerability.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T22:08:29Z","date_published":"2026-07-21T22:08:29Z","id":"https://feed.craftedsignal.io/briefs/2026-07-fast-xml-parser-dos/","summary":"A vulnerability in fast-xml-parser allows an attacker to bypass entity expansion limits by crafting XML documents with multiple DOCTYPE declarations, leading to excessive CPU usage, memory exhaustion, and denial of service.","title":"fast-xml-parser: Repeated DOCTYPE Declarations Bypass Entity Expansion Limits Leading to DoS","url":"https://feed.craftedsignal.io/briefs/2026-07-fast-xml-parser-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Fast-Xml-Parser (\u003e= 5.9.3, \u003c 5.10.1)","version":"https://jsonfeed.org/version/1.1"}