{"$schema":"https://docs.oasis-open.org/csaf/csaf/v2.1/schema/csaf.json","document":{"category":"csaf_security_advisory","csaf_version":"2.1","distribution":{"tlp":{"label":"CLEAR"}},"lang":"en","notes":[{"category":"summary","text":"nvulnlookup parses untrusted XML (RSS / Atom feeds, CAPEC) with the `quick-xml` crate. Version 0.39.4 carries two HIGH-severity denial-of-service defects fixed in 0.41.0: RUSTSEC-2026-0195 (CVSS 7.5) - unbounded namespace-declaration allocation in `NsReader` enabling memory-exhaustion DoS on a crafted document; and RUSTSEC-2026-0194 (CVSS 7.5) - quadratic run time when checking a start tag for duplicate attribute names, an algorithmic-complexity DoS. The direct `quick-xml` dependency (crates/vl-feeders + workspace-hack) is bumped 0.39 -> 0.41, and the two transitive re-exporters `rss` (2.0.13 -> 2.1.0) and `atom_syndication` (0.12.8 -> 0.12.9) are bumped so that quick-xml 0.39.4 is removed from the dependency tree entirely. Post-bump `cargo audit` no longer reports either advisory.","title":"Summary"},{"category":"description","text":"Both defects are reachable through nvulnlookup's feed-ingestion paths, which parse attacker-influenceable XML from remote sources:\n\nRUSTSEC-2026-0195 (CWE-770 / CWE-400) - `quick-xml`'s `NsReader` accumulated namespace declarations without bound; a document declaring many namespaces drives unbounded memory allocation until the process is OOM-killed.\n\nRUSTSEC-2026-0194 (CWE-407 / CWE-400) - checking a start tag for duplicate attribute names was O(n^2) in the attribute count; a tag with many attributes causes quadratic CPU blow-up.\n\nRemediation applied: quick-xml is bumped to 0.41.0 in the two first-party manifests (crates/vl-feeders/Cargo.toml and workspace-hack/Cargo.toml). Because `rss` 2.0.13 and `atom_syndication` 0.12.8 pinned quick-xml 0.39, they were also bumped (rss -> 2.1.0, atom_syndication -> 0.12.9), which removes quick-xml 0.39.4 from Cargo.lock completely (verified: `grep -c '0.39.4' Cargo.lock` == 0; `cargo tree -i quick-xml@0.39.4` empty).\n\nVerification: `cargo audit` after the bump reports neither RUSTSEC-2026-0194 nor RUSTSEC-2026-0195 (both previously present); the remaining audit findings (crossbeam-epoch RUSTSEC-2026-0204, quinn-proto RUSTSEC-2026-0185, anyhow RUSTSEC-2026-0190) are pre-existing and unrelated to this change.","title":"Description"},{"category":"details","text":"Manifest changes:\n  crates/vl-feeders/Cargo.toml   quick-xml \"0.39\" -> \"0.41\"; zip \"7\" -> \"8\"\n  workspace-hack/Cargo.toml      quick-xml \"0.39\" -> \"0.41\"\nLockfile: quick-xml 0.41.0 only; rss 2.1.0; atom_syndication 0.12.9.\n\nThe CVSS v3.1 base score 7.5 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H are taken from the RustSec advisories (remote, unauthenticated, availability-only DoS); no confidentiality or integrity impact. Scores are sourced, not estimated.","title":"Remediation detail"},{"category":"general","text":"Recommended action: upgrade to an nvulnlookup build containing quick-xml >= 0.41.0 with quick-xml 0.39.4 absent from the dependency tree. Operators running a build that still resolves quick-xml 0.39.x should rebuild against the updated Cargo.lock. The feed ingestion paths (RSS / Atom / CAPEC) are the exposed surface.","title":"Recommended action"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY. ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS INFORMATION INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS."}],"publisher":{"category":"vendor","contact_details":"security@ndaal.eu","issuing_authority":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG Security Team","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","namespace":"https://ndaal.eu/csaf"},"references":[{"category":"self","summary":"This advisory in CSAF 2.1 format","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/csaf/2026/254/ndaal-sa-2026-254.json"},{"category":"external","summary":"RUSTSEC-2026-0195 - quick-xml unbounded namespace-declaration allocation (NsReader) memory-exhaustion DoS","url":"https://rustsec.org/advisories/RUSTSEC-2026-0195"},{"category":"external","summary":"RUSTSEC-2026-0194 - quick-xml quadratic run time on duplicate start-tag attributes","url":"https://rustsec.org/advisories/RUSTSEC-2026-0194"},{"category":"external","summary":"quick-xml crate (crates.io)","url":"https://crates.io/crates/quick-xml"},{"category":"external","summary":"CWE-400 - Uncontrolled Resource Consumption","url":"https://cwe.mitre.org/data/definitions/400.html"},{"category":"external","summary":"CWE-770 - Allocation of Resources Without Limits or Throttling","url":"https://cwe.mitre.org/data/definitions/770.html"},{"category":"external","summary":"CWE-407 - Inefficient Algorithmic Complexity","url":"https://cwe.mitre.org/data/definitions/407.html"},{"category":"external","summary":"nvulnlookup CHANGELOG","url":"https://gitlab.com/vPierre/ndaal_public_nvulnlookup/-/raw/main/vulnerability-lookup-rs/CHANGELOG.md"}],"title":"ndaal Security Advisory: quick-xml 0.39.4 -> 0.41.0 (+ rss 2.1.0, atom_syndication 0.12.9) remediates RUSTSEC-2026-0194 + RUSTSEC-2026-0195 (two HIGH XML-parser DoS) in nvulnlookup","tracking":{"current_release_date":"2026-07-11T00:00:00.000Z","generator":{"engine":{"name":"ndaal CSAF Generator","version":"1.0.0"}},"id":"ndaal-sa-2026-254","initial_release_date":"2026-07-11T00:00:00.000Z","revision_history":[{"date":"2026-07-11T00:00:00.000Z","number":"1.0.0","summary":"Initial security advisory: quick-xml 0.39.4 -> 0.41.0 (+ rss 2.1.0, atom_syndication 0.12.9) remediates RUSTSEC-2026-0195 (namespace-allocation memory-exhaustion DoS) and RUSTSEC-2026-0194 (duplicate-attribute quadratic-runtime DoS), both CVSS v3.1 7.5 HIGH. quick-xml 0.39.4 removed from the tree; cargo audit clears both. Status: final."}],"status":"final","version":"1.0.0"}},"product_tree":{"branches":[{"category":"vendor","name":"ndaal Gesellschaft fuer Sicherheit in der Informationstechnik mbH & Co KG","branches":[{"category":"product_name","name":"nvulnlookup","branches":[{"category":"product_version","name":"0.1.50-quick-xml-0.39.4","product":{"name":"nvulnlookup 0.1.50 resolving quick-xml 0.39.4 (via direct dep + rss 2.0.13 / atom_syndication 0.12.8) - vulnerable to RUSTSEC-2026-0194 + -0195","product_id":"CSAFPID-0001"}},{"category":"product_version","name":"0.1.50-quick-xml-0.41.0","product":{"name":"nvulnlookup 0.1.50 with quick-xml 0.41.0 (rss 2.1.0 / atom_syndication 0.12.9); quick-xml 0.39.4 absent from the tree","product_id":"CSAFPID-0002"}}]}]}]},"vulnerabilities":[{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2026-0195"}],"notes":[{"category":"description","text":"quick-xml < 0.41.0 accumulated namespace declarations without bound in NsReader; a crafted XML document declaring many namespaces drives unbounded allocation until OOM. Reachable via nvulnlookup RSS/Atom/CAPEC feed parsing. CVSS 7.5 (remote, unauthenticated, availability-only).","title":"Description"}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Bump quick-xml to >= 0.41.0 and bump rss (>= 2.1.0) + atom_syndication (>= 0.12.9) so quick-xml 0.39.x is removed from the tree.","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"title":"quick-xml NsReader unbounded namespace-declaration allocation -> memory-exhaustion DoS (RUSTSEC-2026-0195)","references":[{"category":"external","summary":"RUSTSEC-2026-0195","url":"https://rustsec.org/advisories/RUSTSEC-2026-0195"}]},{"ids":[{"system_name":"RustSec Advisory Database","text":"RUSTSEC-2026-0194"}],"notes":[{"category":"description","text":"quick-xml < 0.41.0 checked start-tag attributes for duplicates in O(n^2); a tag with many attributes causes quadratic CPU consumption (algorithmic-complexity DoS). Reachable via nvulnlookup XML feed parsing. CVSS 7.5 (remote, unauthenticated, availability-only).","title":"Description"}],"product_status":{"known_affected":["CSAFPID-0001"],"fixed":["CSAFPID-0002"]},"remediations":[{"category":"vendor_fix","details":"Bump quick-xml to >= 0.41.0 and bump rss (>= 2.1.0) + atom_syndication (>= 0.12.9) so quick-xml 0.39.x is removed from the tree.","product_ids":["CSAFPID-0002"]}],"metrics":[{"content":{"cvss_v3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"cvss_v4":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","baseScore":8.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE"}},"products":["CSAFPID-0001"]}],"title":"quick-xml quadratic run time checking a start tag for duplicate attribute names (RUSTSEC-2026-0194)","references":[{"category":"external","summary":"RUSTSEC-2026-0194","url":"https://rustsec.org/advisories/RUSTSEC-2026-0194"}]}]}