Bug 2442938 (CVE-2026-27942)

Summary: CVE-2026-27942 fast-xml-parser: fast-xml-parser: Stack overflow leads to Denial of Service
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abarbaro, abuckta, alizardo, anjoseph, anthomas, caswilli, dkuc, dschmidt, ehelms, erezende, fdeutsch, ggainey, jchui, jhe, jlanda, jprabhak, juwatts, kaycoth, kshier, ktsao, manissin, mattdavi, mhulan, nboldt, nmoumoul, orabin, oramraz, osousa, pcreech, psrna, rchan, rjohnson, simaishi, smallamp, smcdonal, smullick, stcannon, stirabos, teagle, thason, tmalecek, wtam, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in fast-xml-parser. A user can exploit this flaw by processing specially crafted XML data with the XML builder when the `preserveOrder` option is enabled. This can lead to a stack overflow, causing the application to crash and resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2442968, 2442969    
Bug Blocks:    

Description OSIDB Bzimport 2026-02-26 03:02:17 UTC 
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. Prior to version 5.3.8, the application crashes with stack overflow when user use XML builder with `preserveOrder:true`. Version 5.3.8 fixes the issue. As a workaround, use XML builder with `preserveOrder:false` or check the input data before passing to builder.