PT-2023-24675 · Unknown · Fast-Xml-Parser

7085 · Published 2023-06-06 · Updated 2026-03-09 · CVE-2023-34104

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions fast-xml-parser versions prior to 4.2.4

Description The issue allows special characters in entity names, which are not escaped or sanitized. This can be abused for denial of service (DoS) attacks by crafting an entity name that results in an intentionally bad performing regex, causing the parser to stall for an indefinite amount of time.

Recommendations For versions prior to 4.2.4, upgrade to version 4.2.4 or later. For users unable to upgrade, avoid using DOCTYPE parsing by setting the processEntities: false option.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

CWE-1333

Related Identifiers

CVE-2023-34104

GHSA-6W63-H3FJ-Q4VW

Affected Products

Fast-Xml-Parser

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34104.json · Exploit
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/39b0e050bb909e8499478657f84a3076e39ce76c · Patch
• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34104 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34104 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6w63-h3fj-q4vw · Vendor Advisory
• https://github.com/NaturalIntelligence/fast-xml-parser · Note
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/a4bdced80369892ee413bf08e28b78795a2b0d5b · Note
• https://t.me/cveNotify/154778 · Telegram Post