CVE-2026-92987

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-92987

A flaw was found in roxmltree. This vulnerability allows a remote attacker to cause a denial of service DoS by crafting a malicious XML document with a large number of attributes on a single element. The roxmltree library performs quadratic-time validation of attributes and namespaces during XML...

CVE-2026-92987 roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consume excessive CPU time and cause denial of service...

CVE-2026-92596

A flaw was found in Nodemailer's addressparser component. This vulnerability, due to quadratic time complexity, allows a remote attacker to cause a Denial of Service DoS. By sending a specially crafted email with a large, comma-separated list of addresses, the attacker can block the Node.js event...

EUVD-2026-81296

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

Linux Distros Unpatched Vulnerability : CVE-2026-92987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XM...

CVE-2026-92596 Nodemailer before 9.1.0 Denial of Service via addressparser

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the...

CVE-2026-92596

Nodemailer , a Node.js email-sending library, is affected by a quadratic time complexity vulnerability in its addressparser component (versions before 9.1.0 ). A remote attacker can send a single email containing a crafted comma-separated address list with a large number of addresses, causing the...

CVE-2026-58059

A flaw was found in Bouncy Castle for Java. A remote, unauthenticated attacker could exploit a quadratic-time escaping vulnerability when stringifying X.500 distinguished names. This could lead to a Denial of Service DoS due to excessive resource consumption. Mitigation Limit the maximum string...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

NPM: xmldom: Quadratic-time attribute deduplication

NPM: xmldom: Quadratic-time attribute deduplication vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

xmldom: Quadratic-time attribute deduplication

Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...

GHSA-8344-3JMQ-59R6 xmldom: Quadratic-time attribute deduplication

Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM NamedNodeMap. Each insertion first performs a linear scan of all already-inserted attributes to enforce the DOM uniqueness rule no two attributes with the same qualified name /...

GHSA-X4FP-J954-R2F4 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser

Summary On the @xmldom/xmldom 0.8.x line, parsing an XML end tag whose name is followed by a long run of whitespace and then a non-whitespace character triggers quadratic-time regular-expression backtracking ReDoS, so a single small crafted end tag stalls the Node.js event loop. It is reachable...

NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge vulnerability discovered by ? in WordPress Npm xmldom versions = 0.3.0, = 0.6.0...

xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Summary xmldom's malformed-input error-recovery path has two quadratic-time On² behaviors that a single crafted input triggers together, so a tiny, highly compressible document tens of KB stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under...

GHSA-93R5-FHX6-VMG9 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

Summary xmldom's malformed-input error-recovery path has two quadratic-time On² behaviors that a single crafted input triggers together, so a tiny, highly compressible document tens of KB stalls the Node.js event loop for multiple seconds. It is reachable from DOMParser.parseFromString under...

CVE-2026-86428

commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly-named attributes. Attackers can submit Markdown with numerous distinct attribute names to cause quadratic-time attribute merging and filtering, consuming...

CVE-2026-86433

commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::findTargetAndDirection performs quadratic-time sibling list scanning. Unauthenticated attackers can submit approximately 32 KB of repeated attribute blocks t...