CVE-2024-41818highCWE-400

CVE-2024-41818: falha de alta gravidade em NaturalIntelligence fast-xml-parser

ReDOS at currency parsing fast-xml-parser

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar fast-xml-parser+ Monitorar fast-xml-parser

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
NaturalIntelligence · fast-xml-parser
CVEs relacionadas — NaturalIntelligence fast-xml-parser

No mesmo produto, das mais perigosas para as menos.

CVE-2023-34104HIGHRegex Injection via Doctype EntitiesEPSS 1.1%CVE-2026-26278HIGHfast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)EPSS 0.9%CVE-2026-33036HIGHfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)EPSS 0.6%CVE-2026-25128HIGHfast-xml-parser has RangeError DoS Numeric Entities BugEPSS 0.6%CVE-2026-27942LOWfast-xml-parser has stack overflow in XMLBuilder with preserveOrderEPSS 0.5%CVE-2026-25896CRITICALfast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesEPSS 0.5%