7.5Alta
CVE-2026-26278fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
Descripción
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a very small XML input, it’s possible to make the parser spend seconds or even minutes processing a single request, effectively freezing the application. Version 5.3.6 fixes the issue. As a workaround, avoid using DOCTYPE parsing by `processEntities: false` option.
Debilidad (CWE):
CWE-776
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| advanced cluster security | 4.8 | — | |
| advanced cluster security | 4.9 | — | |
| NaturalIntelligence | fast-xml-parser | >= 5.0.0, < 5.3.6, >= 4.1.3, < 4.5.4 | |
| openshift data foundation | 4.18 | — | |
| openshift data foundation | 4.19 | — | |
| openshift data foundation | 4.20 | — | |
| Red Hat | Migration Toolkit for Applications 8 | all versions | |
| Red Hat | Red Hat Advanced Cluster Security 4.8 | all versions | |
| Red Hat | Red Hat Advanced Cluster Security 4.9 | all versions | |
| Red Hat | Red Hat Developer Hub 1.8 | all versions | |
| Red Hat | Red Hat Developer Hub 1.9 | all versions | |
| Red Hat | Red Hat Openshift Data Foundation 4.18 | all versions | |
| Red Hat | Red Hat Openshift Data Foundation 4.19 | all versions | |
| Red Hat | Red Hat Openshift Data Foundation 4.20 | all versions | |
| Red Hat | Red Hat OpenShift GitOps | all versions | |
| Red Hat | Red Hat OpenShift Virtualization 4 | all versions | |
| Red Hat | Red Hat Satellite 6 | — | |
| Red Hat | Red Hat Satellite 6.18 | all versions | |
| Red Hat | Self-service automation portal 2 | all versions | |
| rhdh | 1.8 | — | |
| rhdh | 1.9 | — | |
| satellite | 6.18 | — |
Referencias y parches
- https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj ExploitVendor Advisory
- https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77 Patch
- https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.6 ProductRelease Notes
- https://access.redhat.com/errata/RHSA-2026:40984
- https://access.redhat.com/errata/RHSA-2026:41941
- https://access.redhat.com/errata/RHSA-2026:41944
- https://access.redhat.com/errata/RHSA-2026:51349
- https://access.redhat.com/errata/RHSA-2026:6174
- https://access.redhat.com/errata/RHSA-2026:6802
- https://access.redhat.com/errata/RHSA-2026:7110
- https://access.redhat.com/errata/RHSA-2026:7128
- https://access.redhat.com/security/cve/CVE-2026-26278
- https://bugzilla.redhat.com/show_bug.cgi?id=2441120
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-26278.json
Coincidencias CPE (NVD) (1)
cpe:2.3:a:naturalintelligence:fast-xml-parser:*:*:*:*:*:*:*:*≥ 4.1.3 < 5.3.6