[williamareynolds]

Affected crate(s)

• xmloxide (45,694 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• Upstream issue asking the maintainer to confirm this advisory: jonwiggins/xmloxide !71
• Fix: jonwiggins/xmloxide@d606e11 (released in 0.4.4 on 2026-07-20; the commit message cites CVE-2026-61727 / GHSA-7jmw-29gc-ffx4)
• I reported this privately on 2026-06-23 through GitHub private vulnerability reporting, as GHSA-7jmw-29gc-ffx4. GitHub's CNA assigned CVE-2026-61727 on 2026-07-10. The GHSA is still in draft.

Severity

Allows unauthenticated remote denial of service through stack exhaustion in cases such as SAML certificate parsing, among others. A small document whose DTD internal subset has an <!ELEMENT> content model with deeply nested ( makes the parser recurse without bound and aborts the process. CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), CWE-674.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate

I have asked the maintainer to resolve the advisory directly in this issue. They have been unresponsive on the GHSA and via email for the past several months.

[djc]

Please use the pull request template (which, among other things, asks for confirmation from a maintainer that they think an advisory is appropriate).

[williamareynolds]

Please use the pull request template (which, among other things, asks for confirmation from a maintainer that they think an advisory is appropriate).

Sorry about that. I didn't really intend for that to be posted yet. I've updated to the right template and I've linked the public issue where I've asked the author to publish the advisory.

[djc]

Feel free to ping me here if they haven't responded in 2 weeks.

[williamareynolds]

Feel free to ping me here if they haven't responded in 2 weeks.

@djc it's been two weeks with no response.