Bug 2526843 (CVE-2026-83615)

Summary: CVE-2026-83615 xmldom: @xmldom/xmldom: xmldom: Denial of Service via quadratic memory consumption
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, akhatavk, alizardo, aos-team-art-private, asdas, cdrage, dpaolell, gmalinko, janstey, jchui, jdelft, jhe, jupierce, ktsao, lchilton, lgarciaa, mbiarnes, nboldt, oaljalju, pdelbell, ppalepu, ppostler, prdhamdh, psrna, rhel-process-autobot, rstepani, rushinde, sfeifer, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in xmldom, a JavaScript library for parsing XML documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document. When processed, this document would cause the library to consume an excessive amount of memory, leading to the application running out of resources and becoming unavailable, a condition known as Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2527250, 2527251, 2527253, 2527257, 2527261, 2527265    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-01 15:12:36 UTC 
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.