CVE-2026-41673

Published: May 7, 2026Modified: Jul 15, 2026Deferred

8.7

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: security-advisories@github.com (Secondary)

Description

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

References (17)

https://github.com/xmldom/xmldom/commit/17678a2a73ecbd1a2da90f3d47dc23da9cef81aa

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/291257493cb0eb6980eda83b162a9c4e6d7d2597

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/2d6d6916ed8a4c223db1f6d7560ab4544c465b0f

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/430357c7b6333108856e917bf2367afe5ceb6f8a

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/4845ef109221df0890825de2822fbe77afba3afe

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/8834218c85ac2a4d757b9587c9028e67c2f7b6c3

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/8b7cfd1491314abdc347261921d7334ff15f7112

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/b0620383abc1df067f3ce1014c43ae1bc1161eeb

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/commit/e6edcab6bef5bcdba0b220bb35442aa72f452b84

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/releases/tag/0.8.13

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/releases/tag/0.9.10

Source: security-advisories@github.com

https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw

Source: security-advisories@github.com

https://access.redhat.com/errata/RHSA-2026:26234

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://access.redhat.com/security/cve/CVE-2026-41673

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://bugzilla.redhat.com/show_bug.cgi?id=2467630

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41673.json

Source: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Timeline

No history available yet.