2 results · Feed
-
High 7.5
Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
`NsReader` resolves namespaces by calling `NamespaceResolver::push` for every `Start`/`Empty` event *before* the event is returned to the caller. `push` iterated all `xmlns` / `xmlns:*` attributes on the start tag and, for each one, appended the prefix bytes …
-
High 7.5
Quadratic run time when checking a start tag for duplicate attribute names
`BytesStart::attributes()` returns an `Attributes` iterator which, by default (`with_checks(true)`), rejects a start tag that repeats an attribute name. For each attribute yielded, the iterator compared the new name against every name seen so far in the same …