Security
فارسی
All products

Red Hat Fuse 7/xmldom

Red Hat · Package
16 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serializationCVE-2026-83610 · GHSA-6GMQ-8VP8-GCM6 @xmldom/xmldomxmldom npmRed Hat Medium Fix reported
xmldom has XML node injection through unvalidated comment serializationCVE-2026-41672 · GHSA-J759-J44W-7FR8 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom has XML injection through unvalidated DocumentType serializationCVE-2026-41674 · GHSA-F6WW-3GGP-FR8H @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom has XML node injection through unvalidated processing instruction serializationCVE-2026-41675 · GHSA-X6WF-F3PX-WCQX @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Uncontrolled recursion in XML serialization leads to DoSCVE-2026-41673 · GHSA-2V35-W6HQ-6MFW @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Quadratic-time attribute deduplicationCVE-2026-83613 · GHSA-8344-3JMQ-59R6 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Processing Instruction Target Injection Bypasses requireWellFormedCVE-2026-83616 · GHSA-C7Q8-3CH8-VQPV @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminatorCVE-2026-83617 · GHSA-JXJR-3G7G-3944 @xmldom/xmldomRed Hat Fuse 7/xmldom npmRed Hat High Fix reported
xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parserCVE-2026-83619 · GHSA-X4FP-J954-R2F4 @xmldom/xmldomRed Hat Build of Podman Desktop/rh-podman-desktop.git npmRed Hat High Fix reported
xmldom: Quadratic-memory consumptionCVE-2026-83615 · GHSA-965W-775F-MR7G @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text mergeCVE-2026-83614 · GHSA-93R5-FHX6-VMG9 @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: DocType `name` Injection Bypasses requireWellFormedCVE-2026-83608 · GHSA-27P8-2357-5QQV @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathCVE-2026-83609 · GHSA-3PX3-54CX-RMW9 @xmldom/xmldomRed Hat Build of Podman Desktop/rh-podman-desktop.git npmRed Hat High Fix reported
xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing contentCVE-2026-83611 · GHSA-6H8R-XR42-GP59 @xmldom/xmldomxmldom npmRed Hat Medium Fix reported
xmldom: Element name injection via createElement() bypasses requireWellFormedCVE-2026-83607 · GHSA-W2RR-34G9-RVRJ @xmldom/xmldomxmldom npmRed Hat High Fix reported
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormedCVE-2026-83605 · GHSA-4W3W-2RP5-G8JM @xmldom/xmldomxmldom npmRed Hat High Fix reported