Medium severity4.3NVD Advisory· Published Dec 18, 2022· Updated Jun 17, 2026
CVE-2021-4249
CVE-2021-4249
Description
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5- Range: <1.9.1.0
- osv-coords2 versions
>= 0.5.0, < 1.9.1.0+ 1 more
- (no CPE)range: >= 0.5.0, < 1.9.1.0
- (no CPE)range: < 1.10.1.0-2.1
- unspecified/xml-conduitv5Range: 0.5.0
Patches
Vulnerability mechanics
References
4- github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939eanvdPatchThird Party Advisory
- github.com/snoyberg/xml/pull/161nvdPatchThird Party Advisory
- hackage.haskell.org/package/xml-conduit-1.9.1.0nvdRelease NotesVendor Advisory
- vuldb.comnvdThird Party Advisory
News mentions
0No linked articles in our index yet.