PSF-2026-34

Element.findall and fully-consumed Element.iterfind exhibit On^2 time complexity when using XPath index predicates e.g. 1, last, last-N on XML documents with many same-tag siblings. Element.find is only affected when the first match is near the end of the sibling list, such as with last or...

CPython 安全特征问题漏洞

CPython is a Python interpreter implemented in C language by the Python Foundation. CPython has a security feature vulnerability, which stems from insufficient entropy in Expat hash flood protection mechanisms. This vulnerability may allow specially crafted XML documents to trigger a hash flood...

CVE-2025-10990 Rexml: rexml: denial of service via inefficient regex parsing

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression regex parsing when processing hex numeric character references &x...; in XML documents. This could lead to a Regular Expression Denial of Service ReDoS, impacting the availability of the affected component...

The vulnerability of the XSLT implementation for converting XML documents in Firefox browsers allows attackers to trigger a service failure or execute arbitrary code.

The vulnerability of the XSLT transformation language for XML documents in Firefox browsers arises due to incorrect checking of number formatting boundaries during formatting operations. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary code...

libxml2: Heap-based buffer overflow in xmlParseXmlDecl

A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash...