CVE-2026-83614

A flaw was found in xmldom. Two independent quadratic paths in the XML DOM (Document Object Model) parser can lead to a denial of service (DoS). A remote attacker could exploit this by providing specially crafted XML input, causing the parser to repeatedly rescan malformed tag names or reindex and rebuild strings during normalization. This excessive processing consumes system resources, making the application unresponsive.

Important: A denial of service flaw exists in the xmldom library due to quadratic-time processing of malformed XML input. This vulnerability can lead to excessive resource consumption and unresponsiveness in Red Hat products that parse untrusted XML, including OpenShift Container Platform, Red Hat JBoss Fuse, Red Hat OpenShift AI, Red Hat Build of Podman Desktop, Red Hat Developer Hub, Red Hat Enterprise Linux (Grafana), and Red Hat In-Vehicle OS.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.