CVE-2026-73569
published 2026-08-13CVE-2026-73569: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1…
PriorityP350high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.51%
42.3th percentile
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advanced-cluster-security | rhacs-main-rhel8 | — | — |
| advanced-cluster-security | rhacs-main-rhel9 | — | — |
| ansible-automation-platform | automation-portal | — | — |
| ansible-automation-platform | bootc-automation-portal-rhel9 | — | — |
| container-native-virtualization | kubevirt-console-plugin | — | — |
| container-native-virtualization | kubevirt-console-plugin-rhel9 | — | — |
| mta | mta-ui-rhel9 | — | — |
| naturalintelligence | fast-xml-parser | — | — |
| odf4 | mcg-core-rhel9 | — | — |
| odf4 | ocs-client-console-rhel9 | — | — |
| odf4 | odf-console-rhel9 | — | — |
| odf4 | odf-multicluster-console-rhel9 | — | — |
| openshift-gitops-1 | argocd-rhel8 | — | — |
| openshift-gitops-1 | argocd-rhel9 | — | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
NaturalIntelligence fast-xml-parser up to 5.10.0 XML Parser OrderedObjParser.js addInputEntities resource consumption
vuldb·2026-09-19·CVSS 8.7
CVE-2026-73569 [HIGH] NaturalIntelligence fast-xml-parser up to 5.10.0 XML Parser OrderedObjParser.js addInputEntities resource consumption
A vulnerability was found in NaturalIntelligence fast-xml-parser up to 5.10.0 and classified as problematic. The affected element is the function addInputEntities of the file src/xmlparser/OrderedObjParser.js of the component XML Parser. The manipulation results in resource consumption.
This vulnerability is identified as CVE-2026-73569. The attack can be executed remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
Red Hat
fast-xml-parser: fast-xml-parser: Denial of Service via repeated DOCTYPE declarations
vendor_redhat·2026-08-13·CVSS 8.7
CVE-2026-73569 [HIGH] CWE-776 fast-xml-parser: fast-xml-parser: Denial of Service via repeated DOCTYPE declarations
fast-xml-parser: fast-xml-parser: Denial of Service via repeated DOCTYPE declarations
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.
A flaw was found in fast-xml-pars
No detection rules found.
No public exploits indexed.
2026-08-13
Published