roxmltree vulnerabilities

CVEs whose affected-version data names the roxmltree package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-92987High· 7.5

5d ago

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single element to consu…

▾ TwilightRazrFalcon · roxmltreeEPSS 0.35%via NVD