VYPR
← All advisories
Unrated severityNVD Advisory· Published Dec 31, 2019· Updated Aug 5, 2024

CVE-2019-20201

CVE-2019-20201

Description

An issue was discovered in ezXML 0.8.3 through 0.8.6. The ezxml_parse_* functions mishandle XML entities, leading to an infinite loop in which memory allocations occur.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

ezXML 0.8.3-0.8.6 has an infinite loop in ezxml_decode due to improper XML entity handling, leading to denial of service via memory exhaustion.

Vulnerability

The ezXML library versions 0.8.3 through 0.8.6 contain a denial of service vulnerability in the ezxml_parse_* functions. The ezxml_decode function mishandles XML entity references, causing a loop that does not terminate on crafted input. This results in repeated memory allocations without bound [1].

Exploitation

An attacker can provide a specially crafted XML file to an application using ezXML. No authentication or special privileges are required; the attacker only needs to deliver the malicious XML to a parser call. The victim process will enter an infinite loop, rapidly allocating memory until system resources are exhausted [1].

Impact

Successful exploitation leads to a denial of service condition. The affected process becomes unresponsive or crashes due to memory exhaustion. No data integrity or confidentiality is compromised, but availability is severely impacted [1].

Mitigation

As of the reference, the bug report remains open. However, a comment suggests that the issue is resolved by the fix for bug 26, though no specific patch version is mentioned [1]. Users should update to a version of ezXML that includes the fix for bug 26, or avoid parsing untrusted XML files with affected versions. No CVE listing in KEV was identified.

References
  1. ezXML / Bugs / #16 Denial of Service vulnerability (infinite loop) while parsing malicious XML files

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

59

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.