Bug 2536068 (CVE-2026-92987) - CVE-2026-92987 roxmltree: roxmltree: Denial of Service via Quadratic Parsing
Summary: CVE-2026-92987 roxmltree: roxmltree: Denial of Service via Quadratic Parsing
Keywords:
Status: NEW
Alias: CVE-2026-92987
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2537034 2537035 2537036 2537037 2537038 2537039 2537040 2537041 2537042 2537044 2537045 2537047 2537048 2537049 2537050 2537051 2537052 2537053 2537054 2537055 2537056 2537057 2537058 2537059 2537043 2537046
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 14:40 UTC by OSIDB Bzimport
Modified: 2026-09-18 18:22 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 14:40:12 UTC 
roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service.
Note You need to log in before you can comment on or make changes to this bug.