fast-xml-parser Entity Expansion Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in fast-xml-parser versions 4.0.0-beta.3 prior to 5.5.5. The issue arises from a bypass in entity expansion limits, allowing numeric character references and standard XML entities to evade configured restrictions. This vulnerability can be exploited by supplying a large number of entity references, leading to excessive memory usage and CPU consumption, potentially crashing the application.

Impact

Exploitation of this vulnerability causes significant memory allocation and CPU usage, with the potential to crash the application due to out-of-memory conditions.

Reproduction

The vulnerability can be reproduced by parsing XML data that includes a high volume of numeric entity references, such as 100,000 or more. Even with strict entity expansion limits set, these references bypass the limits and cause excessive output length and memory consumption.

Remediation

Users can upgrade to fast-xml-parser version 5.5.6 or later, where this vulnerability has been fixed.