Raw JSON
{
"$schema": "https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json",
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.1",
"distribution": {
"tlp": {
"label": "CLEAR"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "nvulnlookup parses untrusted XML (RSS / Atom feeds, CAPEC) with the `quick-xml` crate. Version 0.39.4 carries two HIGH-severity denial-of-service defects fixed in 0.41.0: RUSTSEC-2026-0195 (CVSS 7.5) - unbounded namespace-declaration allocation in `NsReader` enabling memory-exhaustion DoS on a crafted document; and RUSTSEC-2026-0194 (CVSS 7.5) - quadratic run time when checking a start tag for duplicate attribute names, an algorithmic-complexity DoS. The direct `quick-xml` dependency (crates/vl-feeders + workspace-hack) is bumped 0.39 -> 0.41, and the two transitive re-exporters `rss` (2.0.13 -> 2.1.0) and `atom_syndication` (0.12.8 -> 0.12.9) are bumped so that quick-xml 0.39.4 is removed from the dependency tree entirely. Post-bump `cargo audit` no longer reports either advisory.",
"title": "Summary"
},
{
"category": "description",
"text": "Both defects are reachable through nvulnlookup's feed-ingestion paths, which parse attacker-influenceable XML from remote sources:\n\nRUSTSEC-2026-0195 (CWE-770 / CWE-400) - `quick-xml`'s `NsReader` accumulated namespace declarations without bound; a document declaring many namespaces drives unbounded memory allocation until the process is OOM-killed.\n\nRUSTSEC-2026-0194 (CWE-407 / CWE-400) - checking a start tag for duplicate attribute names was O(n^2) in the attribute count; a tag with many attributes causes quadratic CPU blow-up.\n\nRemediation applied: quick-xml is bumped to 0.41.0 in the two first-party manifests (crates/vl-feeders/Cargo.toml and workspace-hack/Cargo.toml). Because `rss` 2.0.13 and `atom_syndication` 0.12.8 pinned quick-xml 0.39, they were also bumped (rss -> 2.1.0, atom_syndication -> 0.12.9), which removes quick-xml 0.39.4 from Cargo.lock completely (verified: `grep -c '0.39.4' Cargo.lock` == 0; `cargo tree -i quick-xml@0.39.4` empty).\n\nVerification: `cargo audit` after the bump reports neither RUSTSEC-2026-0194 nor RUSTSEC-2026-0195 (both previously present); the remaining audit findings (crossbeam-epoch RUSTSEC-2026-0204, quinn-proto RUSTSEC-2026-0185, anyhow RUSTSEC-2026-0190) are pre-existing and unrelated to this change.",
"title": "Description"
},
{
"category": "details",
"text": "Manifest changes:\n crates/vl-feeders/Cargo.toml quick-xml \"0.39\" -> \"0.41\"; zip \"7\" -> \"8\"\n workspace-hack/Cargo.toml quick-xml \"0.39\" -> \"0.41\"\nLockfile: quick-xml 0.41.0 only; rss 2.1.0; atom_syndication 0.12.9.\n\nThe CVSS v3.1 base score 7.5 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H are taken from the RustSec advisories (remote, unauthenticated, availability-only DoS); no confidentiality or integrity impact. Scores are sourced, not estimated.",
"title": "Remediation detail"
},
{
"category": "general",
"text": "Recommended action: upgrade to an nvulnlookup build containing quick-xml >= 0.41.0 with quick-xml 0.39.4 absent from the dependency tree. Operators running a build that still resolves quick-xml 0.39.x should rebuild against the updated Cargo.lock. The feed ingestion paths (RSS / Atom / CAPEC) are the exposed surface.",
"title": "Recommended action"
},
{
"category": "legal_disclaimer",
"text": "THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."
}
],
"publisher": {
"category": "vendor",
"contact_details": "security@ndaal.eu",
"issuing_authority": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"namespace": "https://ndaal.eu/csaf"
},
"references": [
{
"category": "self",
"summary": "This advisory in CSAF 2.1 format",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/254/ndaal-sa-2026-254.json"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0195 - quick-xml unbounded namespace-declaration allocation (NsReader) memory-exhaustion DoS",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0195"
},
{
"category": "external",
"summary": "RUSTSEC-2026-0194 - quick-xml quadratic run time on duplicate start-tag attributes",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0194"
},
{
"category": "external",
"summary": "quick-xml crate (crates.io)",
"url": "https://crates.io/crates/quick-xml"
},
{
"category": "external",
"summary": "CWE-400 - Uncontrolled Resource Consumption",
"url": "https://cwe.mitre.org/data/definitions/400.html"
},
{
"category": "external",
"summary": "CWE-770 - Allocation of Resources Without Limits or Throttling",
"url": "https://cwe.mitre.org/data/definitions/770.html"
},
{
"category": "external",
"summary": "CWE-407 - Inefficient Algorithmic Complexity",
"url": "https://cwe.mitre.org/data/definitions/407.html"
},
{
"category": "external",
"summary": "nvulnlookup CHANGELOG",
"url": "https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/CHANGELOG.md"
}
],
"title": "ndaal Security Advisory: quick-xml 0.39.4 -> 0.41.0 (+ rss 2.1.0, atom_syndication 0.12.9) remediates RUSTSEC-2026-0194 + RUSTSEC-2026-0195 (two HIGH XML-parser DoS) in nvulnlookup",
"tracking": {
"current_release_date": "2026-07-11T00:00:00.000Z",
"generator": {
"engine": {
"name": "ndaal CSAF Generator",
"version": "1.0.0"
}
},
"id": "ndaal-sa-2026-254",
"initial_release_date": "2026-07-11T00:00:00.000Z",
"revision_history": [
{
"date": "2026-07-11T00:00:00.000Z",
"number": "1.0.0",
"summary": "Initial security advisory: quick-xml 0.39.4 -> 0.41.0 (+ rss 2.1.0, atom_syndication 0.12.9) remediates RUSTSEC-2026-0195 (namespace-allocation memory-exhaustion DoS) and RUSTSEC-2026-0194 (duplicate-attribute quadratic-runtime DoS), both CVSS v3.1 7.5 HIGH. quick-xml 0.39.4 removed from the tree; cargo audit clears both. Status: final."
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"category": "vendor",
"name": "ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG",
"branches": [
{
"category": "product_name",
"name": "nvulnlookup",
"branches": [
{
"category": "product_version",
"name": "0.1.50-quick-xml-0.39.4",
"product": {
"name": "nvulnlookup 0.1.50 resolving quick-xml 0.39.4 (via direct dep + rss 2.0.13 / atom_syndication 0.12.8) - vulnerable to RUSTSEC-2026-0194 + -0195",
"product_id": "CSAFPID-0001"
}
},
{
"category": "product_version",
"name": "0.1.50-quick-xml-0.41.0",
"product": {
"name": "nvulnlookup 0.1.50 with quick-xml 0.41.0 (rss 2.1.0 / atom_syndication 0.12.9); quick-xml 0.39.4 absent from the tree",
"product_id": "CSAFPID-0002"
}
}
]
}
]
}
]
},
"vulnerabilities": [
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2026-0195"
}
],
"notes": [
{
"category": "description",
"text": "quick-xml < 0.41.0 accumulated namespace declarations without bound in NsReader; a crafted XML document declaring many namespaces drives unbounded allocation until OOM. Reachable via nvulnlookup RSS/Atom/CAPEC feed parsing. CVSS 7.5 (remote, unauthenticated, availability-only).",
"title": "Description"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Bump quick-xml to >= 0.41.0 and bump rss (>= 2.1.0) + atom_syndication (>= 0.12.9) so quick-xml 0.39.x is removed from the tree.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "quick-xml NsReader unbounded namespace-declaration allocation -> memory-exhaustion DoS (RUSTSEC-2026-0195)",
"references": [
{
"category": "external",
"summary": "RUSTSEC-2026-0195",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0195"
}
]
},
{
"ids": [
{
"system_name": "RustSec Advisory Database",
"text": "RUSTSEC-2026-0194"
}
],
"notes": [
{
"category": "description",
"text": "quick-xml < 0.41.0 checked start-tag attributes for duplicates in O(n^2); a tag with many attributes causes quadratic CPU consumption (algorithmic-complexity DoS). Reachable via nvulnlookup XML feed parsing. CVSS 7.5 (remote, unauthenticated, availability-only).",
"title": "Description"
}
],
"product_status": {
"known_affected": [
"CSAFPID-0001"
],
"fixed": [
"CSAFPID-0002"
]
},
"remediations": [
{
"category": "vendor_fix",
"details": "Bump quick-xml to >= 0.41.0 and bump rss (>= 2.1.0) + atom_syndication (>= 0.12.9) so quick-xml 0.39.x is removed from the tree.",
"product_ids": [
"CSAFPID-0002"
]
}
],
"metrics": [
{
"content": {
"cvss_v3": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"cvss_v4": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE"
}
},
"products": [
"CSAFPID-0001"
]
}
],
"title": "quick-xml quadratic run time checking a start tag for duplicate attribute names (RUSTSEC-2026-0194)",
"references": [
{
"category": "external",
"summary": "RUSTSEC-2026-0194",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0194"
}
]
}
]
}