High severityNVD Advisory· Published Jun 5, 2023· Updated Jan 8, 2025
CVE-2023-34411
CVE-2023-34411
Description
The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
xml-rscrates.io | >= 0.8.9, < 0.8.14 | 0.8.14 |
Affected products
2- Rust/xml-rsdescription
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-7gf7-jv65-wjmhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-34411ghsaADVISORY
- github.com/00xc/xml-rs/commit/0f084d45aa53e4a27476961785f59f2bd7d59a9fghsaWEB
- github.com/netvl/xml-rs/commit/014d808be900c85a0afc5ccdfe668be040d175aaghsaWEB
- github.com/netvl/xml-rs/commit/c09549a187e62d39d40467f129e64abf32efc35cghsaWEB
- github.com/netvl/xml-rs/compare/0.8.13...0.8.14ghsaWEB
- github.com/netvl/xml-rs/pull/226ghsaWEB
News mentions
0No linked articles in our index yet.