CVE-2021-4249
xml-conduit unbounded entity expansion
Published Nov 14, 2025 · updated May 30, 2026
# xml-conduit unbounded entity expansion A vulnerability was found in *xml-conduit*. It has been classified as problematic. Affected is an unknown function of the file of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is . It is recommended to upgrade the affected component.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Nov 14, 2025 · OSV.dev
Detected
# xml-conduit unbounded entity expansion A vulnerability was found in *xml-conduit*. It has been classified as problematic. Affected is an unknown function of the file of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is . It is r
May 30, 2026 · OSV.dev
Fix available
xml-conduit fixed in 1.9.1.0
May 30, 2026 · OSV.dev
Fix available
xml-conduit fixed in 1.9.1.0
May 30, 2026 · OSV.dev
Updated
# xml-conduit unbounded entity expansion A vulnerability was found in *xml-conduit*. It has been classified as problematic. Affected is an unknown function of the file of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is . It is r
Affected
- Hackage xml-conduit0.5.0 → 1.9.1.0