RUSTSEC-2026-0195: Unbounded namespace-declaration allocation in `NsReader` enables memory-exhaustion denial of service
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 3/5
- Tiempo estimado
- 1-2 días
- Aptitud para principiantes
- 48/100
Línea de trabajo
El issue no menciona archivos ni pruebas de graph-node; empieza por localizar la declaración de la dependencia quick-xml y los usos de NsReader. Comprueba si el proyecto puede actualizar quick-xml a >=0.41.0, luego ejecuta las pruebas relevantes de graph-node y confirma que las rutas de análisis afectadas siguen funcionando sin el comportamiento de asignación vulnerable.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Unbounded namespace-declaration allocation in
NsReaderenables memory-exhaustion denial of service
| Details | |
|---|---|
| Package | quick-xml |
| Version | 0.40.1 |
| URL | https://github.com/tafia/quick-xml/issues/970 |
| Date | 2026-06-29 |
| Patched versions | >=0.41.0 |
NsReader resolves namespaces by calling NamespaceResolver::push for every
Start/Empty event before the event is returned to the caller. push
iterated all xmlns / xmlns:* attributes on the start tag and, for each one,
appended the prefix bytes to an internal buffer and pushed a NamespaceBinding
(32 bytes on 64-bit) to an internal Vec, with no upper bound on the number of
declarations.
Impact
A start tag with N namespace declarations drove roughly 3× the tag's byte
size in NamespaceResolver heap, allocated inside quick-xml before the
NsReader consumer ever received the event and could inspect or reject it. A
consumer that bounds its input size therefore still cannot bound this
allocation: an M-byte start tag yields on the order of 3 × M bytes of
resolver heap the caller never sees.
On untrusted XML this lets a remote, unauthenticated attacker force large heap
allocations with a single start tag. With several NsReaders running
concurrently on independent inputs (a common server pattern), the allocations
stack and can exhaust process memory, causing the operating system to kill the
process (OOM). This was confirmed against a real-world RPKI relying party (NLnet
Labs Routinator), where concurrent RRDP validation workers parsing a crafted
snapshot.xml exceeded the memory limit and the process was OOM-killed.
Affected code paths
Consumers using NsReader (which always calls NamespaceResolver::push before
yielding Start/Empty), or calling NamespaceResolver::push directly. A plain
Reader that does not perform namespace resolution is not affected.
Remediation
Upgrade to quick-xml >= 0.41.0. NamespaceResolver::push now rejects a start
tag that declares more than DEFAULT_MAX_DECLARATIONS_PER_ELEMENT (256)
namespace bindings, returning the new NamespaceError::TooManyDeclarations
instead of allocating without limit. The limit is configurable via
NamespaceResolver::set_max_declarations_per_element (use usize::MAX to
restore the previous unbounded behavior), and NsReader::resolver_mut() is
provided to reach it.
There is no clean workaround for NsReader consumers before 0.41.0, as the
allocation happens inside the reader with no configuration knob to cap it.
See advisory page for additional details.
- Lenguaje dominante
- Rust
- Estrellas
- 3.2k
- Forks
- 1.1k
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Preparar el entorno
Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de graphprotocol/graph-node
-
current: include emits an all-null bucket for dimensionless aggregations, nulling the whole responseAbierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
graphprotocol/graph-node#6719 ·
-
RUSTSEC-2026-0194: Quadratic run time when checking a start tag for duplicate attribute namesAbierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
graphprotocol/graph-node#6673 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 70/100
graphprotocol/graph-node#6650 · 1 comentario ·
-
Dificultad 4/5 3-5 días Aptitud para principiantes 48/100
graphprotocol/graph-node#6722 ·
-
Dificultad 3/5 1-2 días Aptitud para principiantes 68/100
graphprotocol/graph-node#6721 ·
Todos los issues de graphprotocol/graph-node
Issues similares
-
`categorize_command` has no `uv` arm, so every `rtk uv …` row counts as `other` in the ecosystem mixAbiertoarea:api bug good first issue priority:low
Dificultad 1/5 Menos de una hora Aptitud para principiantes 92/100
rtk-ai/rtk#4316 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 92/100
Los mantenedores suelen responder en 1 día
-
area/cli kind/bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 90/100
Los mantenedores suelen responder en 1 día
-
enhancement
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
-
good first issue open-endedness: low type: new feature
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100