CVE-2021-4249

Published: Dec 18, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.

Affected (1)

Products: Haskell: Xml Conduit

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Haskell Xml Conduit	Before 1.9.1.0

Related CWEs

Improper Resource Shutdown or Release

The product does not release or incorrectly releases a resource before it is made available for re-use.

References (8)

https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea

Source: cna@vuldb.com

PatchThird Party Advisory

https://github.com/snoyberg/xml/pull/161

Source: cna@vuldb.com

PatchThird Party Advisory

https://hackage.haskell.org/package/xml-conduit-1.9.1.0

Source: cna@vuldb.com

Release NotesVendor Advisory

https://vuldb.com/?id.216204

Source: cna@vuldb.com

Third Party Advisory

https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/snoyberg/xml/pull/161

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://hackage.haskell.org/package/xml-conduit-1.9.1.0

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://vuldb.com/?id.216204

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.