CVE-2023-34411

xml-rs vulnerable to denial of service via invalid token in XML document

7.5 HighFix available

The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document. The earliest affected version is 0.8.9.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.16%Up 1.1 points since Jun 5, 2023

What each source reports

NVD Score used 7.5

Record: CVE-2023-34411
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-611
Updated: 2026-11-02

CVE List 7.5

Record: CVE-2023-34411
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-611
Updated: 2026-11-02

EUVDEUVD-2023-1731 7.5

Record: EUVD-2023-1731
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-7gf7-jv65-wjmh 7.5

xml-rs vulnerable to denial of service via invalid token in XML document

The xml-rs crate >= 0.8.9 and < 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.

Record: GHSA-7gf7-jv65-wjmh
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-611, CWE-617
Updated: 2026-11-02

OSV 7.5

Record: CVE-2023-34411
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVGHSA-7gf7-jv65-wjmh 7.5

xml-rs vulnerable to denial of service via invalid token in XML document

The xml-rs crate >= 0.8.9 and < 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.

Record: GHSA-7gf7-jv65-wjmh
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-611, CWE-617
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-34411 7.5

Record: UBUNTU-CVE-2023-34411
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected products

xml library project library

Affected packages

Affected packages
Package	Affected	Fixed
`xml-rs` crates.io	0.8.9 up to 0.8.14	0.8.14
`rust-xml-rs` Ubuntu:20.04:LTS	All versions, plus listed versions 0.8.0-10.8.0-1build1	None known
`rust-xml-rs` Ubuntu:22.04:LTS	All versions, plus listed versions 0.8.3-1	None known
`rust-xml-rs` Ubuntu:24.04:LTS	All versions, plus listed versions 0.8.3-10.8.19-1	None known
`rust-xml-rs` Ubuntu:25.10	All versions, plus listed versions 0.8.19-1build1	None known
`rust-xml-rs` Ubuntu:26.10	All versions, plus listed versions 0.8.19-1build1	None known
`rust-xml-rs` Ubuntu:26.04:LTS	All versions, plus listed versions 0.8.19-1build1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-34411 is a high vulnerability (CVSS 7.5) in Xml Library Project Library, published June 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.16%, the 67th percentile. Fixed in xml-rs 0.8.14.

References

Show 5 moreShow less