{"id":"CVE-2019-15542","aliases":["EUVD-2021-1575","GHSA-5hp8-35wj-m525","RUSTSEC-2019-0001"],"status":"published","title":"Uncontrolled recursion in ammonia","description":"An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01411,"percentile":0.72858,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-674"],"published":"2019-04-27T12:00:00Z","modified":"2026-10-24T10:30:54Z","fixes":[{"ecosystem":"crates.io","package":"ammonia","fixed_in":["2.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"ammonia","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ammonia","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"ammonia","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"2.1.0"}]}]}],"products":[{"vendor":"ammonia_project","product":"ammonia"}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2019-0001.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15542","tags":["advisory"]},{"url":"https://github.com/rust-ammonia/ammonia/blob/master/CHANGELOG.md#210","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5hp8-35wj-m525"},{"url":"https://github.com/rust-ammonia/ammonia","tags":["package"]},{"url":"https://crates.io/crates/ammonia","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-15542","description":"An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.","status":"published","published":"2019-08-26T17:10:15Z","modified":"2024-08-05T00:49:13.754Z","updated_at":"2026-11-02T14:20:21.397307Z"}],"euvd":[{"id":"EUVD-2021-1575","description":"An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.","status":"published","published":"2019-08-26T17:10:15Z","modified":"2024-08-05T00:49:13Z","updated_at":"2026-11-03T02:40:35.584574Z"}],"ghsa":[{"id":"GHSA-5hp8-35wj-m525","title":"Uncontrolled recursion in ammonia","description":"An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.","status":"published","published":"2021-08-25T20:44:03Z","modified":"2023-01-11T05:06:01Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:36:12.361159Z"}],"nvd":[{"id":"CVE-2019-15542","description":"An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.","status":"published","published":"2019-08-26T18:15:12.467Z","modified":"2026-06-17T02:20:35.833Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T14:05:23.725587Z"}],"osv":[{"id":"CVE-2019-15542","description":"An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.","status":"published","published":"2019-08-26T18:15:12.467Z","modified":"2026-10-24T10:30:54.932891699Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.361782Z"},{"id":"GHSA-5hp8-35wj-m525","title":"Uncontrolled recursion in ammonia","description":"An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.","status":"published","published":"2021-08-25T20:44:03Z","modified":"2023-11-08T04:01:13.675058Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-674"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"RUSTSEC-2019-0001","title":"Uncontrolled recursion leads to abort in HTML serialization","description":"Affected versions of this crate did use recursion for serialization of HTML\nDOM trees.\n\nThis allows an attacker to cause abort due to stack overflow by providing\na pathologically nested input.\n\nThe flaw was corrected by serializing the DOM tree iteratively instead.","status":"published","published":"2019-04-27T12:00:00Z","modified":"2023-11-08T04:01:13.675058Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:39.492624Z"}]}}