{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-83613", "tracking": { "current_release_date": "2026-10-16T12:23:05.067668Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-83613", "initial_release_date": "2026-09-01T15:34:36.424705Z", "revision_history": [ { "date": "2026-09-01T15:34:36.424705Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (7).| CWES updated (1)." }, { "date": "2026-09-01T15:34:40.448028Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-01T15:39:15.448574Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (3).| References created (7).| CWES updated (1)." }, { "date": "2026-09-01T15:39:26.080011Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-02T00:27:35.620490Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (15).| Product Identifiers created (8).| Products created (1).| References created (9).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-02T00:27:44.403521Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-09-02T05:12:07.653359Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-09-02T05:12:08.711467Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-09-02T07:13:46.016062Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (58).| References created (9).| CWES updated (1)." }, { "date": "2026-09-02T07:13:56.237259Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-09-03T06:31:01.514506Z", "number": "11", "summary": "Products removed (24)." }, { "date": "2026-09-03T06:31:10.418725Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-09-03T14:08:26.174895Z", "number": "13", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-03T14:08:39.119794Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-09-04T02:25:38.966341Z", "number": "15", "summary": "References created (1)." }, { "date": "2026-09-04T12:11:03.854975Z", "number": "16", "summary": "References created (1)." }, { "date": "2026-09-04T12:41:09.154479Z", "number": "17", "summary": "Exploits created (1).| Unknown change." }, { "date": "2026-09-04T12:41:16.837950Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-09-07T07:56:16.027834Z", "number": "19", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-07T12:22:59.927005Z", "number": "20", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CWES updated (1)." }, { "date": "2026-09-07T12:23:02.447030Z", "number": "21", "summary": "NCSC Score updated." }, { "date": "2026-09-08T20:05:39.202822Z", "number": "22", "summary": "Source connected.| CVE status created. (valid)| News created (1)." }, { "date": "2026-09-08T20:05:41.200293Z", "number": "23", "summary": "NCSC Score updated." }, { "date": "2026-09-09T06:40:03.161541Z", "number": "24", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (10).| CWES updated (1)." }, { "date": "2026-09-09T12:22:03.187915Z", "number": "25", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:22:36.352167Z", "number": "26", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (3).| References created (9).| CWES updated (1)." }, { "date": "2026-09-09T12:22:39.243025Z", "number": "27", "summary": "NCSC Score updated." }, { "date": "2026-09-09T12:22:40.318752Z", "number": "28", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (3).| References created (8).| CWES updated (1)." }, { "date": "2026-09-09T12:22:42.564032Z", "number": "29", "summary": "NCSC Score updated." }, { "date": "2026-09-09T12:53:18.651259Z", "number": "30", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:53:21.128356Z", "number": "31", "summary": "NCSC Score updated." }, { "date": "2026-09-09T12:53:35.679109Z", "number": "32", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:53:46.104578Z", "number": "33", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:53:55.055135Z", "number": "34", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:54:13.657783Z", "number": "35", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T12:54:24.793424Z", "number": "36", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T15:17:16.230318Z", "number": "37", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-09T15:17:18.717275Z", "number": "38", "summary": "NCSC Score updated." }, { "date": "2026-09-22T00:38:59.442822Z", "number": "39", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| Product Remediations created (6).| References created (47).| CWES updated (1)." }, { "date": "2026-09-22T00:39:03.543076Z", "number": "40", "summary": "NCSC Score updated." }, { "date": "2026-09-24T15:20:01.696530Z", "number": "41", "summary": "EPSS updated." }, { "date": "2026-09-24T15:20:06.757398Z", "number": "42", "summary": "NCSC Score updated." }, { "date": "2026-09-28T11:33:13.378578Z", "number": "43", "summary": "Source connected.| CVE status created. (valid)| Products connected (2).| References created (3)." }, { "date": "2026-09-28T11:33:17.173796Z", "number": "44", "summary": "NCSC Score updated." }, { "date": "2026-09-29T12:20:43.159222Z", "number": "45", "summary": "Source connected.| CVE status created. (valid)| Products connected (3).| References created (21)." }, { "date": "2026-09-29T12:50:54.758260Z", "number": "46", "summary": "NCSC Score updated." }, { "date": "2026-09-29T15:26:05.761826Z", "number": "47", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-30T18:43:00.748004Z", "number": "48", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Remediations created (1)." }, { "date": "2026-09-30T18:43:09.450616Z", "number": "49", "summary": "NCSC Score updated." }, { "date": "2026-10-03T00:43:12.885178Z", "number": "50", "summary": "Description removed for source.| Description created for source.| Products connected (2).| Product Remediations created (1).| Products removed (2)." }, { "date": "2026-10-03T00:43:21.509964Z", "number": "51", "summary": "NCSC Score updated." }, { "date": "2026-10-05T11:29:57.471317Z", "number": "52", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-05T11:30:04.190908Z", "number": "53", "summary": "NCSC Score updated." }, { "date": "2026-10-12T08:07:58.636455Z", "number": "54", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-12T08:08:00.878542Z", "number": "55", "summary": "NCSC Score updated." }, { "date": "2026-10-12T08:29:58.262815Z", "number": "56", "summary": "Products created (24)." }, { "date": "2026-10-15T07:06:34.484442Z", "number": "57", "summary": "Products removed (24)." }, { "date": "2026-10-15T07:06:52.469733Z", "number": "58", "summary": "NCSC Score updated." }, { "date": "2026-10-16T06:19:43.098308Z", "number": "59", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-10-16T06:19:53.837521Z", "number": "60", "summary": "NCSC Score updated." }, { "date": "2026-10-16T12:22:27.596529Z", "number": "61", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-10-16T12:22:51.685730Z", "number": "62", "summary": "NCSC Score updated." } ], "status": "interim", "version": "62" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0.7.0|<0.8.15", "product": { "name": "vers:unknown/>=0.7.0|<0.8.15", "product_id": "CSAFPID-9111866" } }, { "category": "product_version_range", "name": "vers:unknown/>=0.9.0|<0.9.12", "product": { "name": "vers:unknown/>=0.9.0|<0.9.12", "product_id": "CSAFPID-9111867" } } ], "category": "product_name", "name": "@xmldom/xmldom" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/0.1.0", "product": { "name": "vers:unknown/0.1.0", "product_id": "CSAFPID-8537894" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.1", "product": { "name": "vers:unknown/0.1.1", "product_id": "CSAFPID-8537895" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.17", "product": { "name": "vers:unknown/0.1.17", "product_id": "CSAFPID-8537896" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.18", "product": { "name": "vers:unknown/0.1.18", "product_id": "CSAFPID-8537897" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.19", "product": { "name": "vers:unknown/0.1.19", "product_id": "CSAFPID-8537898" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.2", "product": { "name": "vers:unknown/0.1.2", "product_id": "CSAFPID-8537899" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.20", "product": { "name": "vers:unknown/0.1.20", "product_id": "CSAFPID-8537900" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.21", "product": { "name": "vers:unknown/0.1.21", "product_id": "CSAFPID-8537901" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.22", "product": { "name": "vers:unknown/0.1.22", "product_id": "CSAFPID-8537902" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.23", "product": { "name": "vers:unknown/0.1.23", "product_id": "CSAFPID-8537903" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.24", "product": { "name": "vers:unknown/0.1.24", "product_id": "CSAFPID-8537904" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.25", "product": { "name": "vers:unknown/0.1.25", "product_id": "CSAFPID-8537905" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.26", "product": { "name": "vers:unknown/0.1.26", "product_id": "CSAFPID-8537906" } }, { "category": "product_version_range", "name": "vers:unknown/0.1.27", "product": { "name": "vers:unknown/0.1.27", "product_id": "CSAFPID-8537907" } }, { "category": "product_version_range", "name": "vers:unknown/0.2.0", "product": { "name": "vers:unknown/0.2.0", "product_id": "CSAFPID-3441066" } }, { "category": "product_version_range", "name": "vers:unknown/0.2.1", "product": { "name": "vers:unknown/0.2.1", "product_id": "CSAFPID-3441067" } }, { "category": "product_version_range", "name": "vers:unknown/0.3.0", "product": { "name": "vers:unknown/0.3.0", "product_id": "CSAFPID-3441068" } }, { "category": "product_version_range", "name": "vers:unknown/0.4.0", "product": { "name": "vers:unknown/0.4.0", "product_id": "CSAFPID-3441069" } }, { "category": "product_version_range", "name": "vers:unknown/0.5.0", "product": { "name": "vers:unknown/0.5.0", "product_id": "CSAFPID-3441070" } }, { "category": "product_version_range", "name": "vers:unknown/0.6.0", "product": { "name": "vers:unknown/0.6.0", "product_id": "CSAFPID-4349372" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0", "product": { "name": "vers:unknown/0.7.0", "product_id": "CSAFPID-3437183" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0+scoped", "product": { "name": "vers:unknown/0.7.0+scoped", "product_id": "CSAFPID-3437184" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.0+unscoped", "product": { "name": "vers:unknown/0.7.0+unscoped", "product_id": "CSAFPID-3437185" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.1", "product": { "name": "vers:unknown/0.7.1", "product_id": "CSAFPID-3437186" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.2", "product": { "name": "vers:unknown/0.7.2", "product_id": "CSAFPID-3437187" } }, { "category": "product_version_range", "name": "vers:unknown/0.7.3", "product": { "name": "vers:unknown/0.7.3", "product_id": "CSAFPID-3437188" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.0", "product": { "name": "vers:unknown/0.8.0", "product_id": "CSAFPID-5037326" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.1", "product": { "name": "vers:unknown/0.8.1", "product_id": "CSAFPID-5037327" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.10", "product": { "name": "vers:unknown/0.8.10", "product_id": "CSAFPID-6245827" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.11", "product": { "name": "vers:unknown/0.8.11", "product_id": "CSAFPID-6245828" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.12", "product": { "name": "vers:unknown/0.8.12", "product_id": "CSAFPID-8740608" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.13", "product": { "name": "vers:unknown/0.8.13", "product_id": "CSAFPID-8932784" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.14", "product": { "name": "vers:unknown/0.8.14", "product_id": "CSAFPID-9104868" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.2", "product": { "name": "vers:unknown/0.8.2", "product_id": "CSAFPID-5037328" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.3", "product": { "name": "vers:unknown/0.8.3", "product_id": "CSAFPID-5037329" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.4", "product": { "name": "vers:unknown/0.8.4", "product_id": "CSAFPID-6245821" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.5", "product": { "name": "vers:unknown/0.8.5", "product_id": "CSAFPID-6245822" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.6", "product": { "name": "vers:unknown/0.8.6", "product_id": "CSAFPID-6245823" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.7", "product": { "name": "vers:unknown/0.8.7", "product_id": "CSAFPID-6245824" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.8", "product": { "name": "vers:unknown/0.8.8", "product_id": "CSAFPID-6245825" } }, { "category": "product_version_range", "name": "vers:unknown/0.8.9", "product": { "name": "vers:unknown/0.8.9", "product_id": "CSAFPID-6245826" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.0", "product": { "name": "vers:unknown/0.9.0", "product_id": "CSAFPID-6245829" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.1", "product": { "name": "vers:unknown/0.9.1", "product_id": "CSAFPID-6245830" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.10", "product": { "name": "vers:unknown/0.9.10", "product_id": "CSAFPID-9104869" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.11", "product": { "name": "vers:unknown/0.9.11", "product_id": "CSAFPID-9104870" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.2", "product": { "name": "vers:unknown/0.9.2", "product_id": "CSAFPID-6245831" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.3", "product": { "name": "vers:unknown/0.9.3", "product_id": "CSAFPID-6245832" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.4", "product": { "name": "vers:unknown/0.9.4", "product_id": "CSAFPID-6245833" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.5", "product": { "name": "vers:unknown/0.9.5", "product_id": "CSAFPID-6245834" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.6", "product": { "name": "vers:unknown/0.9.6", "product_id": "CSAFPID-6245835" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.7", "product": { "name": "vers:unknown/0.9.7", "product_id": "CSAFPID-6245836" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.8", "product": { "name": "vers:unknown/0.9.8", "product_id": "CSAFPID-6245837" } }, { "category": "product_version_range", "name": "vers:unknown/0.9.9", "product": { "name": "vers:unknown/0.9.9", "product_id": "CSAFPID-8740607" } }, { "category": "product_version_range", "name": "vers:unknown/<=0.6.0", "product": { "name": "vers:unknown/<=0.6.0", "product_id": "CSAFPID-2762020" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<=0.6.0", "product": { "name": "vers:unknown/>=0|<=0.6.0", "product_id": "CSAFPID-4972909" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.27", "product": { "name": "vers:unknown/v0.1.27", "product_id": "CSAFPID-3441072" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.28-not-published", "product": { "name": "vers:unknown/v0.1.28-not-published", "product_id": "CSAFPID-3441073" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.28-xmldom-alpha", "product": { "name": "vers:unknown/v0.1.28-xmldom-alpha", "product_id": "CSAFPID-3441074" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0", "product": { "name": "vers:unknown/v0.7.0", "product_id": "CSAFPID-3437191" } }, { "category": "product_version_range", "name": "vers:unknown/xmldom-aplha@v0.1.28", "product": { "name": "vers:unknown/xmldom-aplha@v0.1.28", "product_id": "CSAFPID-3441075" } } ], "category": "product_name", "name": "xmldom" } ], "category": "vendor", "name": "xmldom" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<12.0.12.30", "product": { "name": "vers:unknown/<12.0.12.30", "product_id": "CSAFPID-9477920" } }, { "category": "product_version_range", "name": "vers:unknown/<13.0.9.0", "product": { "name": "vers:unknown/<13.0.9.0", "product_id": "CSAFPID-9477921" } } ], "category": "product_name", "name": "App Connect Enterprise" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<10.5.0.23", "product": { "name": "vers:unknown/<10.5.0.23", "product_id": "CSAFPID-9485661" } }, { "category": "product_version_range", "name": "vers:unknown/<10.6.0.11", "product": { "name": "vers:unknown/<10.6.0.11", "product_id": "CSAFPID-9485662" } }, { "category": "product_version_range", "name": "vers:unknown/<11.0.0.3", "product": { "name": "vers:unknown/<11.0.0.3", "product_id": "CSAFPID-9485663" } } ], "category": "product_name", "name": "DataPower Gateway" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1337768", "product_identification_helper": { "cpe": "cpe:/a:ibm:business_automation_workflow:-" } } } ], "category": "product_name", "name": "IBM Business Automation Workflow" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-5211181", "product_identification_helper": { "cpe": "cpe:/a:ibm:websphere_service_registry_and_repository:-" } } } ], "category": "product_name", "name": "IBM WebSphere Service Registry and Repository" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<5.7.1", "product": { "name": "vers:unknown/<5.7.1", "product_id": "CSAFPID-9512266" } }, { "category": "product_version_range", "name": "vers:unknown/>=5.7.1", "product": { "name": "vers:unknown/>=5.7.1", "product_id": "CSAFPID-9512267" } } ], "category": "product_name", "name": "HPE Telco Service Orchestrator" } ], "category": "vendor", "name": "HPE" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317177", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "product_name", "name": "Oracle Linux" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-5940623", "product_identification_helper": { "cpe": "cpe:/a:redhat:podman_desktop:1" } } } ], "category": "product_name", "name": "Red Hat Build of Podman Desktop" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-1508265", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhdh:1" } } } ], "category": "product_name", "name": "Red Hat Developer Hub" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1.9", "product": { "name": "vers:rpm/1.9", "product_id": "CSAFPID-5760320", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhdh:1.9::el9" } } } ], "category": "product_name", "name": "Red Hat Developer Hub 1.9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1789554285", "product": { "name": "vers:oci/1789554285", "product_id": "CSAFPID-9368042", "product_identification_helper": { "purl": "pkg:oci/rhdh-hub-rhel9@sha256%3Aea53db6012b6fe1c80760624caddb0d3b674614b62cb3c359ed3fde270314eb2?arch=amd64&repository_url=registry.redhat.io/rhdh/rhdh-hub-rhel9&tag=1789554285" } } }, { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1508266" } } ], "category": "product_name", "name": "rhdh-hub-rhel9" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1789558887", "product": { "name": "vers:oci/1789558887", "product_id": "CSAFPID-9368043", "product_identification_helper": { "purl": "pkg:oci/rhdh-operator-bundle@sha256%3A1b8153a28b5a3797104fd32a54e3ac38b3b573ff2d65d99bd257d650eddea1fc?arch=amd64&repository_url=registry.redhat.io/rhdh/rhdh-operator-bundle&tag=1789558887" } } } ], "category": "product_name", "name": "rhdh-operator-bundle" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1789552931", "product": { "name": "vers:oci/1789552931", "product_id": "CSAFPID-9368044", "product_identification_helper": { "purl": "pkg:oci/rhdh-rhel9-operator@sha256%3A036c292951ddf755006c6fefc9e1b8faf9a784757b91785e990bbfb856baa3ff?arch=amd64&repository_url=registry.redhat.io/rhdh/rhdh-rhel9-operator&tag=1789552931" } } } ], "category": "product_name", "name": "rhdh-rhel9-operator" } ], "category": "product_family", "name": "Red Hat Developer Hub" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/10", "product": { "name": "vers:rpm/10", "product_id": "CSAFPID-2858634", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:10" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux 10" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/8", "product": { "name": "vers:rpm/8", "product_id": "CSAFPID-1439317", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:8" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux 8" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/9", "product": { "name": "vers:rpm/9", "product_id": "CSAFPID-1439319", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:9" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux 9" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/7", "product": { "name": "vers:rpm/7", "product_id": "CSAFPID-1439294", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_fuse:7" } } } ], "category": "product_name", "name": "Red Hat Fuse 7" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1439279", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift_ai" } } } ], "category": "product_name", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/4", "product": { "name": "vers:rpm/4", "product_id": "CSAFPID-1439328", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4" } } } ], "category": "product_name", "name": "Red Hat OpenShift Container Platform 4" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-2868420" } } ], "category": "product_name", "name": "grafana" } ], "category": "product_family", "name": "Red Hat Enterprise Linux 10" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1663145" } } ], "category": "product_name", "name": "grafana" } ], "category": "product_family", "name": "Red Hat Enterprise Linux 8" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1496261" } } ], "category": "product_name", "name": "grafana" } ], "category": "product_family", "name": "Red Hat Enterprise Linux 9" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5811359" } } ], "category": "product_name", "name": "odh-mlflow-rhel9" } ], "category": "product_family", "name": "Red Hat OpenShift AI (RHOAI)" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1441120" } } ], "category": "product_name", "name": "ose-console" } ], "category": "product_family", "name": "Red Hat OpenShift Container Platform 4" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-6239273" } } ], "category": "product_name", "name": "rh-podman-desktop.git" } ], "category": "product_family", "name": "Red Hat Build of Podman Desktop" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9105480" } } ], "category": "product_name", "name": "xmldom" } ], "category": "product_family", "name": "Red Hat Fuse 7" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/unknown", "product": { "name": "vers:deb/unknown", "product_id": "CSAFPID-5991503" } } ], "category": "product_name", "name": "node-xmldom" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0.7.0|<0.8.15", "product": { "name": "vers:unknown/>=0.7.0|<0.8.15", "product_id": "CSAFPID-9104839" } }, { "category": "product_version_range", "name": "vers:unknown/>=0.9.0|<0.9.12", "product": { "name": "vers:unknown/>=0.9.0|<0.9.12", "product_id": "CSAFPID-9104838" } } ], "category": "product_name", "name": "xmldom" } ], "category": "vendor", "name": "@xmldom" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-83613", "cwe": { "id": "CWE-407", "name": "Inefficient Algorithmic Complexity" }, "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "CSAFPID-9368043", "CSAFPID-9368044" ] } ], "notes": [ { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-83613.json?alt=media" }, { "category": "description", "text": "## Summary\n\nThe `@xmldom/xmldom` serializer emits `DocumentType.name` verbatim into the\n`` declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h\n(CVE-2026-41674) hardened the serializer's `requireWellFormed` path for a\nDocumentType's sibling fields — `publicId`, `systemId`, and `internalSubset` —\nbut it did **not** add any check for `name`. A `>` (or whitespace) in the name\nterminates the doctype declaration early, letting the remaining characters\nbecome sibling markup in the serialized output.\n\nBecause `requireWellFormed: true` — the recommended mitigation for the prior\nxmldom injection CVEs — performs no validation on the DocType `name`, this is a\nbypass of that control, in the same family as the open element-name\n(GHSA-w2rr-34g9-rvrj) and attribute-name (GHSA-4w3w-2rp5-g8jm) name-injection advisories.\n\n## Details\n\nThe serializer's `DOCUMENT_TYPE_NODE` case runs the `requireWellFormed` block\nonly against `publicId`, `systemId`, and `internalSubset`, then pushes\n`n.name` directly into the buffer between the ``:\n\n- 0.9.x (v0.9.10, `bb7a085`):\n [serializer DocType case, `lib/dom.js#L3256-L3283`](https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L3256-L3283)\n — the `requireWellFormed` block ([#L3259-L3269](https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L3259-L3269))\n validates `publicId`/`systemId`/`internalSubset` but not `name`, which is\n emitted verbatim at [#L3270](https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L3270).\n- 0.8.x (v0.8.13, `e5c1480`):\n [serializer DocType case, `lib/dom.js#L1914-L1946`](https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom.js#L1914-L1946)\n — same structure; `name` is emitted verbatim at [#L1928](https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom.js#L1928).\n- unscoped `xmldom` (v0.6.0, `c80a161`):\n [`lib/dom.js#L1105`](https://github.com/xmldom/xmldom/blob/c80a161172cc4d8733583bf0cf59abfa589f6d9e/lib/dom.js#L1105)\n emits `node.name` verbatim; this line predates `requireWellFormed`, so there\n is no well-formedness path at all.\n\n### Enabling write paths\n\n`DocumentType.name` is a plain, writable own-property, so the enabling vector\ndiffers by line:\n\n- **0.9.x** — `createDocumentType()` validates the name via\n `validateQualifiedName` ([`lib/dom.js#L925-L936`](https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L925-L936),\n validation at [#L926](https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L926)),\n so the deliverable vector is a **direct property write**\n (`dt.name = 'html>\n//\n// requireWellFormed: true did NOT prevent the injection (no exception thrown).\n// The injected ` with no exception.\n\nA browser reproduction does not apply: browsers keep `DocumentType.name`\n`readonly`, so the direct-write vector cannot be reproduced in a browser DOM.\nThe injection is specific to xmldom exposing `name` as writable and serializing\nit without a guard.\n\n## Impact\n\nApplications that build a `DocumentType` node with an attacker-influenced\n`name` — via direct property write on any affected line, or via\n`createDocumentType()` on 0.8.x and the unscoped package — and serialize the\ndocument are vulnerable to XML/markup injection:\n\n- **XML structure injection** — breaking out of the `` declaration\n to inject arbitrary sibling elements, comments, or additional markup into the\n output.\n- **XSS via XHTML** — if the serialized output is served as XHTML or processed\n by a browser-based XML parser, an injected `\n\n// Opt-in path: serialization throws instead of emitting the breakout.\nserializer.serializeToString(doc, { requireWellFormed: true });\n// throws InvalidStateError\n```\n\n### Why the default stays verbatim\n\nW3C DOM Parsing's require-well-formed flag defaults to false, and the browser\n`XMLSerializer` emits the name verbatim in that default mode. Unconditionally\nthrowing would be an unjustified breaking change against that specified default,\nso the guard is opt-in behind `{ requireWellFormed: true }`.\n\n### Residual limitation\n\nThe default serialization path still emits the ill-formed DocType `name`\nverbatim; protection applies only when `requireWellFormed: true` is passed. No\ncreation-time validation is added for the DocType `name`: 0.9.x already validates\nat `createDocumentType`, and the 0.8.x/unscoped creation gap is left unfixed — it\ncannot be closed without a breaking change.", "title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-27p8-2357-5qqv.json?alt=media" }, { "category": "description", "text": "## Summary\n\nxmldom builds the attribute collection of every parsed element by inserting attributes one at a\ntime into a DOM `NamedNodeMap`. Each insertion first performs a **linear scan of all\nalready-inserted attributes** to enforce the DOM uniqueness rule (no two attributes with the same\nqualified name / namespace+local-name). Parsing an element that carries `M` distinct attributes\ntherefore costs `1 + 2 + … + M = O(M²)` comparisons.\n\nBecause the trigger is simply \"one element with many attributes\", the attack payload is a\n**fully well-formed XML document**. No malformed markup, no error recovery, and no non-default\nparser options are involved — parsing completes silently with zero `warning`/`error`/`fatalError`\nevents. An attacker who can submit a modest, highly compressible document (a single element with\ntens of thousands of attributes, ~340 KB uncompressed) can consume seconds of single-threaded CPU\nper request, enabling an unauthenticated denial of service.\n\nThis is distinct from the known quadratic-**memory** namespace-map issue: it burns **CPU** and it\ndoes not require any namespace declarations or nesting.\n\n## Details\n\nThe DOM content handler adds each attribute of a starting element by calling\n`el.setAttributeNode(attr)` in a loop:\n\n```js\n// DOMHandler.startElement\nfor (var i = 0; i < len; i++) {\n\tvar namespaceURI = attrs.getURI(i);\n\tvar value = attrs.getValue(i);\n\tvar qName = attrs.getQName(i);\n\tvar attr = doc.createAttributeNS(namespaceURI, qName);\n\tattr.value = attr.nodeValue = value;\n\tel.setAttributeNode(attr); // O(existing attrs) each — see below\n}\n```\n\nhttps://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom-parser.js#L370-L387\n\n`setAttributeNode` delegates to `NamedNodeMap.setNamedItem`, which calls `getNamedItemNS` to look\nfor an existing attribute with the same namespace URI and local name before appending:\n\n```js\nsetNamedItem: function (attr) {\n\tvar el = attr.ownerElement;\n\tif (el && el !== this._ownerElement) {\n\t\tthrow new DOMException(DOMException.INUSE_ATTRIBUTE_ERR);\n\t}\n\tvar oldAttr = this.getNamedItemNS(attr.namespaceURI, attr.localName); // linear scan\n\tif (oldAttr === attr) {\n\t\treturn attr;\n\t}\n\t_addNamedNode(this._ownerElement, this, attr, oldAttr);\n\treturn oldAttr;\n},\n```\n\nhttps://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L612-L623\n\n`getNamedItemNS` walks the whole list on every call:\n\n```js\ngetNamedItemNS: function (namespaceURI, localName) {\n\tif (!namespaceURI) {\n\t\tnamespaceURI = null;\n\t}\n\tvar i = 0;\n\twhile (i < this.length) {\n\t\tvar node = this[i];\n\t\tif (node.localName === localName && node.namespaceURI === namespaceURI) {\n\t\t\treturn node;\n\t\t}\n\t\ti++;\n\t}\n\treturn null;\n},\n```\n\nhttps://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L702-L715\n\nFor the i-th attribute the scan visits `i-1` entries, so inserting `M` distinct attributes performs\n`Θ(M²)` comparisons. There is no hash index or set keyed by name; the map is a plain\narray-backed structure.\n\nThe same structure exists on 0.8.x. There `setNamedItem` dedups via\n`getNamedItem(attr.nodeName)` instead of `getNamedItemNS`, but that method is likewise a full linear\nscan, so the complexity is identical:\n\n- `startElement` loop / `setAttributeNode`:\n https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom-parser.js#L159-L176\n- `setNamedItem` → linear `getNamedItem`:\n https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom.js#L286-L308\n\nThe linear-scan `NamedNodeMap` predates the `@xmldom/xmldom` fork and is present unchanged in the\nunscoped `xmldom` package back to its earliest published release. In `xmldom@0.1.0`, parsing already\ninserts each attribute one at a time (`DOMHandler.startElement` loops calling\n`setAttributeNS` → `setAttributeNode` → `NamedNodeMap.setNamedItem`), and `setNamedItem` dedups by\ncalling `getNamedItemNS`, which is a full linear `while (i--)` scan of the already-inserted\nattributes — the identical `O(M²)` structure. The whole unscoped line (`0.1.0` … `0.6.0`) is\ntherefore affected; the earliest published tag (`0.1.0`) was verified to contain the per-insert\nlinear dedup scan.\n\n## Proof of Concept\n\nA single well-formed element with `M` distinct attributes. No malformed markup and no options:\n\n```js\n'use strict';\nvar DOMParser = require('@xmldom/xmldom').DOMParser;\n\nfunction buildDoc(m) {\n\tvar parts = new Array(m);\n\tfor (var i = 0; i < m; i++) parts[i] = 'a' + i + '=\"x\"';\n\treturn ''; // \n}\n\nfor (var _i = 0, sizes = [2000, 4000, 8000, 16000, 32000]; _i < sizes.length; _i++) {\n\tvar m = sizes[_i];\n\tvar xml = buildDoc(m);\n\tvar t0 = process.hrtime.bigint();\n\tvar doc = new DOMParser().parseFromString(xml, 'text/xml'); // silent: no error events\n\tvar ms = Number(process.hrtime.bigint() - t0) / 1e6;\n\tconsole.log(m + ' attrs, ' + xml.length + ' bytes -> ' + ms.toFixed(1) + ' ms; parsed=' +\n\t\tdoc.documentElement.attributes.length);\n}\n```\n\nMeasured with Node.js v18.20.8 (wall-clock; absolute numbers vary by host, the **scaling** is the\nload-bearing fact):\n\n**`@xmldom/xmldom` 0.9.10:**\n\n| M (attributes) | input bytes | time (ms) | ratio vs prev |\n|---:|---:|---:|---:|\n| 2000 | 18,894 | 13.4 | — |\n| 4000 | 38,894 | 38.7 | ×2.9 |\n| 8000 | 78,894 | 100.8 | ×2.6 |\n| 16000 | 164,894 | 406.2 | ×4.0 |\n| 32000 | 340,894 | 2149.5 | ×5.3 |\n\n**`@xmldom/xmldom` 0.8.13:**\n\n| M (attributes) | input bytes | time (ms) |\n|---:|---:|---:|\n| 2000 | 18,894 | 10.6 |\n| 4000 | 38,894 | 19.9 |\n| 8000 | 78,894 | 75.9 |\n| 16000 | 164,894 | 657.7 |\n| 32000 | 340,894 | 1643.2 |\n\n**`xmldom` (unscoped) 0.6.0:** 4000 → 28.2 ms, 8000 → 131.8 ms, 16000 → 545.2 ms (≈ ×4 per doubling).\n\nTime grows ≈ ×4 per doubling of `M` — quadratic. About **340 KB of well-formed input costs ~1.6–2.1 s\nof single-threaded CPU**, and it keeps scaling: doubling the attribute count quadruples the cost.\nThe document is trivially generated and compresses to a few kilobytes on the wire.\n\n## Impact\n\nUnauthenticated, remotely triggerable denial of service against any service that parses\nattacker-influenced XML/HTML with xmldom. A single request holds one event-loop thread for seconds;\na handful of concurrent requests can saturate CPU and stall the process. Because the payload is a\nplain well-formed document (one element, many attributes), it passes any \"must be well-formed\" gate\nand reaches the parser before any application-level validation (e.g. schema checks or signature\nverification) can run. The payload is highly compressible, so it is effective over compressed\ntransports.\n\n## Fix Applied\n\nReplaced the per-insert linear duplicate scan on the parse-time dedup path with a name-keyed\nindex, so de-duplicating an element's attributes during parse is O(M) instead of O(M²) — a\nwell-formed-but-hostile attribute list can no longer wedge the parse. Behavior-preserving: attribute\norder and duplicate resolution (last value wins, first position kept) are byte-identical. Non-breaking\nand independent of `requireWellFormed`; ships on both maintained versions.", "title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-8344-3jmq-59r6.json?alt=media" }, { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-83613" }, { "category": "description", "text": "A flaw was found in xmldom, a JavaScript module for parsing XML (Extensible Markup Language) documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing an element with numerous distinct attributes. The way xmldom processes these attributes leads to a significant performance degradation, consuming excessive computational resources. This can cause the application using xmldom to become unresponsive, resulting in a Denial of Service (DoS).", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-83613" }, { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-83613" }, { "category": "description", "text": "Potential security vulnerabilities in HPE Telco Service Orchestrator software that may lead to memory exhaustion, uncontrolled resource consumption, access restriction bypass, and unauthorized data injection.", "title": "hpe - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05155en_us&docLocale=en_US" }, { "category": "description", "text": "xmldom: Quadratic-time attribute deduplication", "title": "microsoft - https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "description", "text": "## Summary\n\nxmldom builds the attribute collection of every parsed element by inserting attributes one at a\ntime into a DOM `NamedNodeMap`. Each insertion first performs a **linear scan of all\nalready-inserted attributes** to enforce the DOM uniqueness rule (no two attributes with the same\nqualified name / namespace+local-name). Parsing an element that carries `M` distinct attributes\ntherefore costs `1 + 2 + … + M = O(M²)` comparisons.\n\nBecause the trigger is simply \"one element with many attributes\", the attack payload is a\n**fully well-formed XML document**. No malformed markup, no error recovery, and no non-default\nparser options are involved — parsing completes silently with zero `warning`/`error`/`fatalError`\nevents. An attacker who can submit a modest, highly compressible document (a single element with\ntens of thousands of attributes, ~340 KB uncompressed) can consume seconds of single-threaded CPU\nper request, enabling an unauthenticated denial of service.\n\nThis is distinct from the known quadratic-**memory** namespace-map issue: it burns **CPU** and it\ndoes not require any namespace declarations or nesting.\n\n## Details\n\nThe DOM content handler adds each attribute of a starting element by calling\n`el.setAttributeNode(attr)` in a loop:\n\n```js\n// DOMHandler.startElement\nfor (var i = 0; i < len; i++) {\n\tvar namespaceURI = attrs.getURI(i);\n\tvar value = attrs.getValue(i);\n\tvar qName = attrs.getQName(i);\n\tvar attr = doc.createAttributeNS(namespaceURI, qName);\n\tattr.value = attr.nodeValue = value;\n\tel.setAttributeNode(attr); // O(existing attrs) each — see below\n}\n```\n\nhttps://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom-parser.js#L370-L387\n\n`setAttributeNode` delegates to `NamedNodeMap.setNamedItem`, which calls `getNamedItemNS` to look\nfor an existing attribute with the same namespace URI and local name before appending:\n\n```js\nsetNamedItem: function (attr) {\n\tvar el = attr.ownerElement;\n\tif (el && el !== this._ownerElement) {\n\t\tthrow new DOMException(DOMException.INUSE_ATTRIBUTE_ERR);\n\t}\n\tvar oldAttr = this.getNamedItemNS(attr.namespaceURI, attr.localName); // linear scan\n\tif (oldAttr === attr) {\n\t\treturn attr;\n\t}\n\t_addNamedNode(this._ownerElement, this, attr, oldAttr);\n\treturn oldAttr;\n},\n```\n\nhttps://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L612-L623\n\n`getNamedItemNS` walks the whole list on every call:\n\n```js\ngetNamedItemNS: function (namespaceURI, localName) {\n\tif (!namespaceURI) {\n\t\tnamespaceURI = null;\n\t}\n\tvar i = 0;\n\twhile (i < this.length) {\n\t\tvar node = this[i];\n\t\tif (node.localName === localName && node.namespaceURI === namespaceURI) {\n\t\t\treturn node;\n\t\t}\n\t\ti++;\n\t}\n\treturn null;\n},\n```\n\nhttps://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L702-L715\n\nFor the i-th attribute the scan visits `i-1` entries, so inserting `M` distinct attributes performs\n`Θ(M²)` comparisons. There is no hash index or set keyed by name; the map is a plain\narray-backed structure.\n\nThe same structure exists on 0.8.x. There `setNamedItem` dedups via\n`getNamedItem(attr.nodeName)` instead of `getNamedItemNS`, but that method is likewise a full linear\nscan, so the complexity is identical:\n\n- `startElement` loop / `setAttributeNode`:\n https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom-parser.js#L159-L176\n- `setNamedItem` → linear `getNamedItem`:\n https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom.js#L286-L308\n\nThe linear-scan `NamedNodeMap` predates the `@xmldom/xmldom` fork and is present unchanged in the\nunscoped `xmldom` package back to its earliest published release. In `xmldom@0.1.0`, parsing already\ninserts each attribute one at a time (`DOMHandler.startElement` loops calling\n`setAttributeNS` → `setAttributeNode` → `NamedNodeMap.setNamedItem`), and `setNamedItem` dedups by\ncalling `getNamedItemNS`, which is a full linear `while (i--)` scan of the already-inserted\nattributes — the identical `O(M²)` structure. The whole unscoped line (`0.1.0` … `0.6.0`) is\ntherefore affected; the earliest published tag (`0.1.0`) was verified to contain the per-insert\nlinear dedup scan.\n\n## Proof of Concept\n\nA single well-formed element with `M` distinct attributes. No malformed markup and no options:\n\n```js\n'use strict';\nvar DOMParser = require('@xmldom/xmldom').DOMParser;\n\nfunction buildDoc(m) {\n\tvar parts = new Array(m);\n\tfor (var i = 0; i < m; i++) parts[i] = 'a' + i + '=\"x\"';\n\treturn ''; // \n}\n\nfor (var _i = 0, sizes = [2000, 4000, 8000, 16000, 32000]; _i < sizes.length; _i++) {\n\tvar m = sizes[_i];\n\tvar xml = buildDoc(m);\n\tvar t0 = process.hrtime.bigint();\n\tvar doc = new DOMParser().parseFromString(xml, 'text/xml'); // silent: no error events\n\tvar ms = Number(process.hrtime.bigint() - t0) / 1e6;\n\tconsole.log(m + ' attrs, ' + xml.length + ' bytes -> ' + ms.toFixed(1) + ' ms; parsed=' +\n\t\tdoc.documentElement.attributes.length);\n}\n```\n\nMeasured with Node.js v18.20.8 (wall-clock; absolute numbers vary by host, the **scaling** is the\nload-bearing fact):\n\n**`@xmldom/xmldom` 0.9.10:**\n\n| M (attributes) | input bytes | time (ms) | ratio vs prev |\n|---:|---:|---:|---:|\n| 2000 | 18,894 | 13.4 | — |\n| 4000 | 38,894 | 38.7 | ×2.9 |\n| 8000 | 78,894 | 100.8 | ×2.6 |\n| 16000 | 164,894 | 406.2 | ×4.0 |\n| 32000 | 340,894 | 2149.5 | ×5.3 |\n\n**`@xmldom/xmldom` 0.8.13:**\n\n| M (attributes) | input bytes | time (ms) |\n|---:|---:|---:|\n| 2000 | 18,894 | 10.6 |\n| 4000 | 38,894 | 19.9 |\n| 8000 | 78,894 | 75.9 |\n| 16000 | 164,894 | 657.7 |\n| 32000 | 340,894 | 1643.2 |\n\n**`xmldom` (unscoped) 0.6.0:** 4000 → 28.2 ms, 8000 → 131.8 ms, 16000 → 545.2 ms (≈ ×4 per doubling).\n\nTime grows ≈ ×4 per doubling of `M` — quadratic. About **340 KB of well-formed input costs ~1.6–2.1 s\nof single-threaded CPU**, and it keeps scaling: doubling the attribute count quadruples the cost.\nThe document is trivially generated and compresses to a few kilobytes on the wire.\n\n## Impact\n\nUnauthenticated, remotely triggerable denial of service against any service that parses\nattacker-influenced XML/HTML with xmldom. A single request holds one event-loop thread for seconds;\na handful of concurrent requests can saturate CPU and stall the process. Because the payload is a\nplain well-formed document (one element, many attributes), it passes any \"must be well-formed\" gate\nand reaches the parser before any application-level validation (e.g. schema checks or signature\nverification) can run. The payload is highly compressible, so it is effective over compressed\ntransports.\n\n## Fix Applied\n\nReplaced the per-insert linear duplicate scan on the parse-time dedup path with a name-keyed\nindex, so de-duplicating an element's attributes during parse is O(M) instead of O(M²) — a\nwell-formed-but-hostile attribute list can no longer wedge the parse. Behavior-preserving: attribute\norder and duplicate resolution (last value wins, first position kept) are byte-identical. Non-breaking\nand independent of `requireWellFormed`; ships on both maintained versions.", "title": "github - https://github.com/advisories/GHSA-8344-3jmq-59r6" }, { "category": "description", "text": "A flaw was found in xmldom, a JavaScript module for parsing XML (Extensible Markup Language) documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing an element with numerous distinct attributes. The way xmldom processes these attributes leads to a significant performance degradation, consuming excessive computational resources. This can cause the application using xmldom to become unresponsive, resulting in a Denial of Service (DoS).", "title": "redhat - https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "description", "text": "xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-83613" }, { "category": "other", "text": "0.00604", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "8.7", "title": "CVSSV4 base score" }, { "category": "other", "text": "6.0", "title": "NCSC Score" }, { "category": "other", "text": "There is news data available from source Bleepingcomputer, There is product data available from source Certbundde, Is related to an uncommon product source, VENDOR FIX as product remediation category", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, There is exploit data available from source Cveprojectv5", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 3\n", "title": "Vendor assessment" } ], "product_status": { "fixed": [ "CSAFPID-9368042", "CSAFPID-9512267" ], "known_affected": [ "CSAFPID-1439279", "CSAFPID-1439294", "CSAFPID-1439317", "CSAFPID-1439319", "CSAFPID-1439328", "CSAFPID-1441120", "CSAFPID-1496261", "CSAFPID-1508265", "CSAFPID-1508266", "CSAFPID-1663145", "CSAFPID-2858634", "CSAFPID-2868420", "CSAFPID-5811359", "CSAFPID-5940623", "CSAFPID-6239273", "CSAFPID-9105480", "CSAFPID-5991503", "CSAFPID-9104839", "CSAFPID-9104838", "CSAFPID-2762020", "CSAFPID-9477920", "CSAFPID-9477921", "CSAFPID-9485661", "CSAFPID-9485662", "CSAFPID-9485663", "CSAFPID-9512266", "CSAFPID-1337768", "CSAFPID-3437183", "CSAFPID-3437184", "CSAFPID-3437185", "CSAFPID-3437186", "CSAFPID-3437187", "CSAFPID-3437188", "CSAFPID-5037326", "CSAFPID-5037327", "CSAFPID-6245827", "CSAFPID-6245828", "CSAFPID-8740608", "CSAFPID-8932784", "CSAFPID-9104868", "CSAFPID-5037328", "CSAFPID-5037329", "CSAFPID-6245821", "CSAFPID-6245822", "CSAFPID-6245823", "CSAFPID-6245824", "CSAFPID-6245825", "CSAFPID-6245826", "CSAFPID-6245829", "CSAFPID-6245830", "CSAFPID-9104869", "CSAFPID-9104870", "CSAFPID-6245831", "CSAFPID-6245832", "CSAFPID-6245833", "CSAFPID-6245834", "CSAFPID-6245835", "CSAFPID-6245836", "CSAFPID-6245837", "CSAFPID-8740607", "CSAFPID-3437191", "CSAFPID-1317177", "CSAFPID-9111866", "CSAFPID-9111867", "CSAFPID-4972909", "CSAFPID-5211181" ], "known_not_affected": [ "CSAFPID-9368043", "CSAFPID-9368044" ] }, "references": [ { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-83613.json?alt=media" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-83613" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83613" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83613" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-83613" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - microsoft", "url": "https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep" }, { "category": "external", "summary": "Source - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-8344-3jmq-59r6" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-83613" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3596.json" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3623.json" }, { "category": "external", "summary": "Source - hpe", "url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05155en_us&docLocale=en_US" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-27p8-2357-5qqv.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-8344-3jmq-59r6.json?alt=media" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0431" }, { "category": "external", "summary": "News - bleepingcomputer", "url": "https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2026-patch-tuesday-fixes-966-flaws-2-zero-days/" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/pull/1071" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/pull/1072" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/releases/tag/0.8.15" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/releases/tag/0.9.12" }, { "category": "external", "summary": "Reference - github; nvd; osv", "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83613" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-83613" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-8344-3jmq-59r6" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-19534" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-33818" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-54272" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-55553" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56853" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56858" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56859" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56860" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-56862" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-67214" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-67312" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-67422" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-69152" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-69192" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-73086" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-75899" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-75931" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-75975" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-76172" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83605" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83607" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83608" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83613" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83614" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83615" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83616" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-83619" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-84292" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-84394" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-84961" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2526830" }, { "category": "external", "summary": "Reference - redhat", "url": "https://catalog.redhat.com/search?gs&searchType=containers&q=rhdh" }, { "category": "external", "summary": "Reference - redhat", "url": "https://developers.redhat.com/rhdh/overview" }, { "category": "external", "summary": "Reference - redhat", "url": "https://docs.redhat.com/en/documentation/red_hat_developer_hub" }, { "category": "external", "summary": "Reference - redhat", "url": "https://issues.redhat.com/browse/RHDHBUGS-3741" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_69248.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "http://linux.oracle.com/errata/ELSA-2026-74085.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3596.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3596" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289740" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7290698" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7292706" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3623.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3623" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289775" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289776" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289778" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289779" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289780" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289783" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289785" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289787" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289788" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289789" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289790" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289791" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289792" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289794" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289795" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289796" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289797" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289798" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7289800" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83613.json" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/xmldom/xmldom/commit/57aec90ac57b4408ae7c5d1746bf2a693b5ed90e" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/xmldom/xmldom/commit/85f12eb4d14b44de33216cfb72b50af4d24e9fdd" }, { "category": "external", "summary": "Reference - osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83608" } ], "remediations": [ { "category": "vendor_fix", "details": "For more about Red Hat Developer Hub, see References links", "product_ids": [ "CSAFPID-5760320", "CSAFPID-9368042" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:69248" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.", "product_ids": [ "CSAFPID-5760320", "CSAFPID-9368042", "CSAFPID-9368043", "CSAFPID-9368044" ] }, { "category": "vendor_fix", "details": "Update to HPE Telco Service Orchestrator v5.7.1 or later.", "product_ids": [ "CSAFPID-9512266" ] } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1317177", "CSAFPID-1337768", "CSAFPID-1439279", "CSAFPID-1439294", "CSAFPID-1439317", "CSAFPID-1439319", "CSAFPID-1439328", "CSAFPID-1441120", "CSAFPID-1496261", "CSAFPID-1508265", "CSAFPID-1508266", "CSAFPID-1663145", "CSAFPID-2762020", "CSAFPID-2858634", "CSAFPID-2868420", "CSAFPID-3437183", "CSAFPID-3437184", "CSAFPID-3437185", "CSAFPID-3437186", "CSAFPID-3437187", "CSAFPID-3437188", "CSAFPID-3437191", "CSAFPID-4972909", "CSAFPID-5037326", "CSAFPID-5037327", "CSAFPID-5037328", "CSAFPID-5037329", "CSAFPID-5211181", "CSAFPID-5811359", "CSAFPID-5940623", "CSAFPID-5991503", "CSAFPID-6239273", "CSAFPID-6245821", "CSAFPID-6245822", "CSAFPID-6245823", "CSAFPID-6245824", "CSAFPID-6245825", "CSAFPID-6245826", "CSAFPID-6245827", "CSAFPID-6245828", "CSAFPID-6245829", "CSAFPID-6245830", "CSAFPID-6245831", "CSAFPID-6245832", "CSAFPID-6245833", "CSAFPID-6245834", "CSAFPID-6245835", "CSAFPID-6245836", "CSAFPID-6245837", "CSAFPID-8740607", "CSAFPID-8740608", "CSAFPID-8932784", "CSAFPID-9104838", "CSAFPID-9104839", "CSAFPID-9104868", "CSAFPID-9104869", "CSAFPID-9104870", "CSAFPID-9105480", "CSAFPID-9111866", "CSAFPID-9111867", "CSAFPID-9477920", "CSAFPID-9477921", "CSAFPID-9485661", "CSAFPID-9485662", "CSAFPID-9485663", "CSAFPID-9512266" ] } ], "title": "CVE-2026-83613" } ] }