CVE-2026-78253

Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readElementText() impacts Qt

Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application crash via stack exhaustion) via a crafted XML document.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-54077

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/arcadedb/integration/importer/SourceDiscovery.java without validation. An authenticated user with SQL command access through /api/v1/command or /api/v1/query can supply HTTP or HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest the results as queryable records. The XML importer also permits DTD processing and external entities, enabling entity expansion. The root-only /api/v1/server administration endpoint is not affected. The fix requires updateSecurity permission, blocks local-network import destinations by default through arcadedb.server.security.importBlockLocalNetworks, supports the arcadedb.server.security.importAllowedLocalPaths file allow-list, and disables XML DTD processing and external entities. This issue is fixed in version 26.6.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arcadedata

Products

Arcadedb

CVE-2023-46035

svg_optimizer Ruby Gem Allows Entity Expansion Leading to Denial of Service

The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fnando

Products

Svg Optimizer

CVE-2026-19248

Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt

QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-11573

Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml)

Uncontrolled recursion (CWE-674) in the QDomDocument/QDomNode serialization path of the Qt XML module (QtXml, qtbase). QDomElementPrivate::save() and QDomNodePrivate::save() recurse mutually, consuming one stack frame per level of element nesting with no depth limit, no configurable bound and no error return. A document with deeply nested elements parses successfully but exhausts the call stack and terminates the process when serialized. Reachable via QDomDocument::toByteArray() (Qt 4.0 and later), QDomDocument::toString(), QDomDocument::toCString(), QDomNode::save(), and operator<<(QTextStream&, const QDomNode&). Denial of service only — no code execution and no memory disclosure.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Qt

Products

Qt

CVE-2026-16180

IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improper validation of XML entities.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

App Connect Enterprise Integration Bus For Z\/os Integration Bus For Zos

CVE-2026-58234

Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)

SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact on availability with no impact on confidentiality and integrity.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Sap Se

Products

Sap Process Integration (soap Adapter)

CVE-2026-81723

NLTK before 3.10.3 Quadratic CPU Exhaustion via XMLCorpusView

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to cause severe CPU consumption and denial of service through affected readers like BNCCorpusReader.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-44020

Docling: Unsafe XML Entity Expansion in USPTO Patent Backend

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could read arbitrary files from the server filesystem, perform Server-Side Request Forgery (SSRF) attacks, or cause denial of service through entity expansion (Billion Laughs attack). The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x. This vulnerability is fixed in 2.74.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Docling Docling-project

Products

Docling Docling

CVE-2026-41673

xmldom: Denial of service via uncontrolled recursion in XML serialization

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Xmldom

Products

Xmldom

CVE-2026-78681

NLTK before 3.10.3 Entity Expansion DoS via ElementTree

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Nltk

Products

Nltk

CVE-2026-12993

Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Apicurio Registry Build Of Apicurio Registry

CVE-2026-56859

Add recursion depth guard during decode in encoding/xml

Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Encoding/xml

CVE-2026-33818

Enforce maximum recursion depth in encoding/asn1

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Encoding/asn1

CVE-2026-73569

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Naturalintelligence

Products

Fast-xml-parser

CVE-2026-23822

Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service

A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system. NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

Arubaos Arubaos

CVE-2026-14979

IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack

IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Engineering Lifecycle Management

CVE-2026-3415

XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service

The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during validation operations. This behavior can occur when an attacker supplies crafted XML payloads to the relevant mediator flows with sufficient privileges. Successful exploitation may allow a highly privileged actor to read files accessible within the server hosting the affected product. Additionally, it may be possible to trigger outbound requests to unintended internal or external locations, depending on the server environment and network configuration. Specially crafted XML payloads can also lead to excessive resource consumption during parsing, impacting the availability of the product.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Wso2 Api Control Plane Wso2 Api Manager Wso2 Carbon Api Gateway and 3 more

CVE-2026-32327

Apache Portable Runtime Utility: apr-util XML stack recursion crash

A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function. Users are recommended to upgrade to version 1.6.4, which fixes this issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Apr-util Portable Runtime Utility

CVE-2026-14865

XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Telerik Ui For Asp.net Ajax