encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

ROOT-APP-MAVEN-CVE-2026-40998 CVE-2026-40998 in org.springframework.ws:spring-xml - Patched by Root

Root has patched CVE-2026-40998 in the org.springframework.ws:spring-xml package for Root:Maven. Multiple fixed versions available...

firefox: thunderbird: Use-after-free in the XML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the XML component...

CVE-2026-63498: Improper Neutralization of Input During Web Page Generation

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/objecttype/id/files/fileid allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with the inline=true parameter. The...

RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:71420)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71420 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable...

PT-2026-99157

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

PT-2026-97931

Mini-XML 4.0.5 contains a memory leak vulnerability in mxml load data during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released,...

CVE-2026-88385: Undefined Security Weakness

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88385

The Mini-XML 4.0.5 library is vulnerable to a memory leak within the mxml_load_data() function during the parsing of malformed XML. Specifically, specially crafted XML input can cause text nodes allocated by mxmlNewText() to become unlinked before a parse error triggers the cleanup path. These or...

EUVD-2026-86274

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

CVE-2026-61741: Improper Restriction of XML External Entity Reference

http4s-scala-xml provides EntityDecoderF, scala.xml.Elem instances that parse XML message bodies. Prior to versions 0.24.1 and 1.0.0-M39, these decoders used a javax.xml.parsers.SAXParserFactory obtained from SAXParserFactory.newInstance without any security configuration. With the JDK's default...

CVE-2026-88385

Mini-XML 4.0.5 contains a memory leak vulnerability in mxmlloaddata during malformed XML parsing. Specially crafted XML input can cause text nodes allocated by mxmlNewText to become unlinked before a parse error transfers control to the cleanup path. These orphaned nodes are not released, resulti...

PT-2026-98284

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The SOAP XML parser contains a flaw where the cleanup xml node function recurses once per XML nesting level without a depth limit. An unauthenticated attacker ca...

PT-2026-98145

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.7.0 Description An authenticated user with file-management access can upload malicious XML and XSLT Extensible Stylesheet Language Transformations attachments. The API endpoint 'GET /api/v1/object type/id/files/fil...

PT-2026-98218

Name of the Vulnerable Software and Affected Versions http4s-scala-xml versions prior to 0.24.1 http4s-scala-xml versions prior to 1.0.0-M39 Description EntityDecoderF, scala.xml.Elem instances used to parse XML message bodies utilize a javax.xml.parsers.SAXParserFactory without security...

PT-2026-99156

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...

PT-2026-99155

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time Issues...