GHSA-g43w-98wp-m694
SilverStripe framework XML Quadratic Blowup Attack
A low level vulnerability has been found in the SilverStripe framework, where the Quadratic Blowup Attack could potentially be exploited to affect the performance of a site.
See http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/ for a writeup.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
What each source reports
GitHub Advisories Score used
SilverStripe framework XML Quadratic Blowup Attack
A low level vulnerability has been found in the SilverStripe framework, where the Quadratic Blowup Attack could potentially be exploited to affect the performance of a site.
See http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/ for a writeup.
- Record
GHSA-g43w-98wp-m694- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-776
- Updated
- 2026-11-02
OSV
SilverStripe framework XML Quadratic Blowup Attack
A low level vulnerability has been found in the SilverStripe framework, where the Quadratic Blowup Attack could potentially be exploited to affect the performance of a site.
See http://mashable.com/2014/08/06/wordpress-xml-blowup-dos/ for a writeup.
- Record
GHSA-g43w-98wp-m694- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-400, CWE-776
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
silverstripe/frameworkPackagist | through 3.1.11 | 3.1.12 |
silverstripe/frameworkPackagist | before 3.1.12, plus listed versions 2.4.102.4.112.4.122.4.132.4.9 Show 45 moreShow less2.5.03.0.103.0.10-rc13.0.113.0.11-rc13.0.123.0.133.0.143.0.2.13.0.33.0.3-rc13.0.3-rc23.0.43.0.53.0.63.0.6-rc13.0.6-rc23.0.73.0.7-rc13.0.83.0.93.0.9-rc13.1.03.1.0-beta13.1.0-beta23.1.0-beta33.1.0-rc13.1.0-rc23.1.0-rc33.1.13.1.103.1.10-rc13.1.10-rc23.1.113.1.11-rc13.1.23.1.2-rc13.1.33.1.3-rc13.1.3-rc23.1.43.1.4-rc13.1.53.1.5-rc13.1.6 | 3.1.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-g43w-98wp-m694 is a medium vulnerability (CVSS 5.3) in silverstripe/framework, published May 23, 2024. No source lists public exploit code. Fixed in silverstripe/framework 3.1.12.
References
github.com/silverstripe/silverstripe-framework/commit/7f983c2bae1dc78ca7217e9af364b2fb71dcefe8
silverstripe.org/software/download/security-releases/ss-2014-017-xml-quadratic-blowup-attack
Left out here: 8 versions. The JSON record has them.