Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2021-4249

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2021-4249
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 11:59 UTC · Revision 1

Source evidence

CVE-2021-4249

core-osv · Original source

Published 18 Dec 2022, 15:15 UTC

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.

osv:CVE-2021-4249
Complete source record
{
  "id": "762a1c061ece82bdd260f4437bf8ca451e0ac5bafa408ee8cb1f6fb038ca01ba",
  "url": "https://osv.dev/vulnerability/CVE-2021-4249",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2021-4249",
    "summary": "A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.",
    "evidence": "osv:CVE-2021-4249",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2021-4249",
      "aliases": [
        "CVE-2021-4249",
        "HSEC-2023-0004"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/snoyberg/xml",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "2b32cc9c1879244aa0c6454e3d5b116c6be18d8c"
                },
                {
                  "fixed": "4be1021791dcdee8b164d239433a2043dc0939ea"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:haskell:xml-conduit:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.9.1.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "4be1021791dcdee8b164d239433a2043dc0939ea"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "xml-hamlet-0.5.0.1",
            "html-conduit-1.3.2.1",
            "xml-conduit/1.9.0",
            "html-conduit-1.3.2",
            "xml-conduit/1.8.0.1",
            "html-conduit-1.3.1",
            "xml-hamlet-0.5.0",
            "xml-conduit-1.8.0",
            "html-conduit-1.3.0",
            "xml-conduit/1.7.1.1",
            "xml-conduit/1.7.1.0",
            "xml-conduit/1.7.0.1",
            "xml-hamlet/0.4.1.1",
            "html-conduit/1.2.1.2",
            "xml-conduit/1.7.0",
            "xml-conduit/1.6.0",
            "1.6.0",
            "xml-conduit/1.5.1",
            "xml-conduit/1.5.0",
            "xml-conduit/1.4.0.3",
            "xml-hamlet/0.4.1",
            "xml-conduit/1.4.0.2",
            "xml-conduit/1.4.0.1",
            "xml-hamlet/0.4.0.12",
            "xml-conduit/1.4.0",
            "html-conduit/1.2.1.1",
            "xml-conduit/1.3.5",
            "xml-conduit/1.3.4.2",
            "xml-conduit/1.3.4.1",
            "xml-conduit/1.3.4",
            "xml-conduit/1.3.3.1",
            "xml-conduit/1.3.3",
            "html-conduit/1.2.1",
            "xml-conduit/1.3.1",
            "xml-hamlet/0.4.0.11",
            "xml-conduit/1.3.0",
            "xml-conduit/1.2.6",
            "html-conduit/1.2.0",
            "xml-conduit/1.2.5.1",
            "xml-conduit/1.2.5",
            "xml-conduit/1.2.4",
            "html-conduit/1.1.1.2",
            "xml-conduit/1.2.3.3",
            "xml-hamlet/0.4.0.10",
            "xml-conduit/1.2.3.2",
            "xml-conduit/1.2.3.1",
            "xml-conduit/1.2.3",
            "html-conduit/1.1.1.1",
            "html-conduit/1.1.1",
            "xml-conduit/1.2.2",
            "xml-conduit/1.2.1.1",
            "html-conduit/1.1.0.6",
            "xml-conduit/1.2.1",
            "xml-hamlet/0.4.0.9",
            "xml-conduit/1.2.0.3",
            "xml-conduit/1.2.0.2",
            "html-conduit/1.1.0.5",
            "xml-hamlet/0.4.0.8",
            "xml-conduit/1.2.0.1",
            "html-conduit/1.1.0.4",
            "xml-hamlet/0.4.0.7",
            "xml-conduit/1.2.0",
            "html-conduit/1.1.0.3",
            "xml-catalog/1.1.0.2",
            "uri-conduit/1.1.1.2",
            "dtd/1.1.0.2",
            "html-conduit/1.1.0.2",
            "dtd/1.1.0.1",
            "xml-hamlet/0.4.0.6",
            "xml-conduit/1.1.0.9",
            "xml-catalog/1.1.0.1",
            "uri-conduit/1.1.1.1",
            "xml-conduit/1.1.0.8",
            "html-conduit/1.1.0.1",
            "xml-hamlet/0.4.0.5",
            "xml-conduit/1.1.0.7",
            "xml-conduit/1.1.0.6",
            "xml-conduit/1.1.0.5",
            "uri-conduit/1.1.1",
            "xml-conduit/1.1.0.4",
            "xml-conduit/1.1.0.3",
            "xml-conduit/1.1.0.2",
            "xml-hamlet/0.4.0.4",
            "xml-conduit/1.1.0.1",
            "xml-conduit/1.1.0",
            "xml-catalog/1.1.0",
            "uri-conduit/1.1.0",
            "html-conduit/1.1.0",
            "dtd/1.1.0",
            "xml-hamlet/0.4.0.3",
            "xml-conduit/1.0.3.3",
            "html-conduit/0.1.0.4",
            "xml-hamlet/0.4.0.2",
            "xml-conduit/1.0.3.2",
            "html-conduit/0.1.0.3",
            "dtd/0.6.1.2",
            "uri-conduit/0.5.0.2",
            "dtd/0.6.1.1",
            "html-conduit/0.1.0.2",
            "xml-hamlet/0.4.0.1",
            "xml-conduit/1.0.3.1",
            "uri-conduit/0.5.0.1",
            "html-conduit/0.1.0.1",
            "dtd/0.6.1",
            "xml-conduit/1.0.3",
            "xml-conduit/1.0.2.1",
            "xml-conduit/1.0.1",
            "xml-hamlet/0.4.0",
            "xml-conduit/1.0.0",
            "xml-catalog/0.8.0",
            "uri-conduit/0.5.0",
            "html-conduit/0.1.0",
            "dtd/0.6.0",
            "xml-conduit/0.7.0.3",
            "xml2html/0.1.2.3",
            "xml-hamlet/0.3.0.1",
            "xml-conduit/0.7.0.2",
            "xml-catalog/0.7.0.1",
            "uri-conduit/0.4.0.1",
            "dtd/0.5.1.1",
            "html-conduit/0.0.1",
            "xml2html/0.1.2.1",
            "dtd/0.5.1",
            "xml-conduit/0.7.0.1",
            "xml2html/0.1.2",
            "xml-hamlet/0.3.0",
            "xml-conduit/0.7.0",
            "xml-catalog/0.7.0",
            "uri-conduit/0.4.0",
            "dtd/0.5.0",
            "xml-conduit/0.6.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4249.json"
          }
        }
      ],
      "modified": "2026-10-20T10:55:01.242727754Z",
      "provider": "osv",
      "references": [
        "https://hackage.haskell.org/package/xml-conduit-1.9.1.0",
        "https://vuldb.com/?id.216204",
        "https://github.com/snoyberg/xml/commit/4be1021791dcdee8b164d239433a2043dc0939ea",
        "https://github.com/snoyberg/xml/pull/161"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2021-4249",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 386699,
  "published_at": "2022-12-18T15:15:10.063+00:00"
}