CVE-2023-34411

crates.io/xml-rs CVE-2023-34411: high 7.5, EPSS 1.16%

xml-rs vulnerable to denial of service via invalid token in XML document

Action: Upgrade xml-rs to 0.8.14 or later.

cargo update -p xml-rs --precise 0.8.14

Affected

Fixed versions

Sources

• osv: GHSA-7gf7-jv65-wjmh
• https://nvd.nist.gov/vuln/detail/CVE-2023-34411
• https://github.com/netvl/xml-rs/pull/226
• https://github.com/00xc/xml-rs/commit/0f084d45aa53e4a27476961785f59f2bd7d59a9f
• https://github.com/netvl/xml-rs/commit/014d808be900c85a0afc5ccdfe668be040d175aa
• https://github.com/netvl/xml-rs/commit/c09549a187e62d39d40467f129e64abf32efc35c
• https://github.com/netvl/xml-rs
• https://github.com/netvl/xml-rs/compare/0.8.13...0.8.14

CVE-2023-34411 · published 2023-06-05T06:30:15Z · modified 2025-01-08T19:00:56Z · JSON