CVE-2021-4249
xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
xml-conduit DOCTYPE Entity Expansion Parse.hs infinite loop
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
- Record
CVE-2021-4249- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Weakness
- CWE-404
- Updated
- 2026-11-02
EUVDEUVD-2021-34096
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
- Record
EUVD-2021-34096- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r5mv-3cq3-727q
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an...
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
- Record
GHSA-r5mv-3cq3-727q- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-404
- Updated
- 2026-11-02
NVD
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
- Record
CVE-2021-4249- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-404
- Updated
- 2026-11-02
OSV
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
- Record
CVE-2021-4249- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-4249
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
- Record
DEBIAN-CVE-2021-4249- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-4249
A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.
- Record
UBUNTU-CVE-2021-4249- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVHSEC-2023-0004 No score
xml-conduit unbounded entity expansion
xml-conduit unbounded entity expansion
A vulnerability was found in xml-conduit. It has been classified
as problematic. Affected is an unknown function of the file
xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE
Entity Expansion Handler. The manipulation leads to infinite loop.
It is possible to launch the attack remotely. Upgrading to version
1.9.1.0 is able to address this issue. The name of the patch is
4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to
upgrade the affected component.
- Record
HSEC-2023-0004- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11086-1 No score
ghc-xml-conduit-1.10.1.0-2.1 on GA media
These are all security issues fixed in the ghc-xml-conduit-1.10.1.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11086-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
haskell-xml-conduitDebian:12 |
before 1.9.1.1-1 | 1.9.1.1-1 |
haskell-xml-conduitDebian:13 |
before 1.9.1.1-1 | 1.9.1.1-1 |
haskell-xml-conduitDebian:14 |
before 1.9.1.1-1 | 1.9.1.1-1 |
xml-conduitHackage |
0.5.0 up to 1.9.1.0, plus listed versions 0.5.0.10.5.10.5.1.10.5.1.20.5.2 Show 45 moreShow less0.5.30.5.3.10.5.40.6.00.6.10.7.00.7.0.10.7.0.20.7.0.31.0.01.0.11.0.1.11.0.21.0.2.11.0.31.0.3.11.0.3.21.0.3.31.1.01.1.0.11.1.0.21.1.0.31.1.0.41.1.0.51.1.0.61.1.0.71.1.0.81.1.0.91.2.01.2.0.11.2.0.21.2.0.31.2.11.2.1.11.2.21.2.31.2.3.11.2.3.21.2.3.31.2.41.2.51.2.5.11.2.61.3.01.3.1 |
1.9.1.0 |
haskell-xml-conduitUbuntu:16.04:LTS |
All versions, plus listed versions 1.2.6-1build31.3.2-11.3.3-1 |
None known |
haskell-xml-conduitUbuntu:18.04:LTS |
All versions, plus listed versions 1.3.5-3build61.5.1-1build11.5.1-1build2 |
None known |
haskell-xml-conduitUbuntu:20.04:LTS |
All versions, plus listed versions 1.8.0.1-2 |
None known |
haskell-xml-conduitUbuntu:22.04:LTS |
All versions, plus listed versions 1.9.0.0-1build4 |
None known |
ghc-xml-conduitopenSUSE:Tumbleweed |
before 1.10.1.0-2.1 | 1.10.1.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4249 is a medium vulnerability (CVSS 4.3) in Haskell Xml-conduit, published December 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in haskell-xml-conduit 1.9.1.1-1.
References
Left out here: 23 versions. The JSON record has them.