# RUSTSEC-2026-0194: Quadratic run time when checking a start tag for duplicate attribute names

> Remote attackers can cause CPU exhaustion and service denial by sending XML with many attributes, affecting Rust applications using this XML parsing library.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 29 Jun 2026

## What is RUSTSEC-2026-0194?

RUSTSEC-2026-0194 is a denial of service vulnerability in quick-xml, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

`BytesStart::attributes()` returns an `Attributes` iterator which, by default
(`with_checks(true)`), rejects a start tag that repeats an attribute name. For
each attribute yielded, the iterator compared the new name against every name
seen so far in the same tag using a linear scan, so a start tag with `N`
distinct attribute names cost `O(N²)` byte comparisons. There was no bound on
`N` other than the size of the buffered start tag.

## Impact

Any code that parses untrusted XML and iterates a start tag's attributes with
the default duplicate check enabled can be made to spend CPU time quadratic in
the number of attributes on a single tag. Because the check is pure computation
with no `.await`/I/O, an I/O-based timeout on the consumer (for example a read
or request timeout) cannot interrupt it while it runs.

Measured cost of a single start tag, release build:

| Attributes on one tag | Time |
|---|---|
| 80,000  | ~6 s   |
| 800,000 | ~10 min |

The cost grows with the square of the attribute count, so a start tag of a few
tens of megabytes can stall a parsing thread for hours. No memory is exhausted
and the parser does not crash; the effect is CPU exhaustion on the thread doing
the parsing: a single crafted start tag can pin a CPU core for minutes to hours,
denying service to that worker. A deployment that places a wall-clock bound on
parsing, or confines it to a non-critical thread, may consider the availability
impact lower.

## Affected code paths

* `BytesStart::attributes()` / `Attributes` iterated with checks enabled (the
  default), and `BytesStart::try_get_attribute`.
* `NsReader`, which resolves namespaces by iterating a tag's attributes and so
  reaches the same check internally.

Consumers that iterate attributes with `.attributes().with_checks(false)` and do
not use `NsReader` are not affected.

This was reported as reachable by a remote, unauthenticated attacker in a
real-world RPKI relying party (NLnet Labs Routinator) via a crafted RRDP
`snapshot.xml`.

## Remediation

Upgrade to `quick-xml >= 0.41.0`, where the duplicate check keeps the linear
scan for start tags with a small number of attributes and switches to an `O(1)`
hash pre-filter above a threshold, making the whole tag `O(N)`. The reported
`AttrError::Duplicated` positions are unchanged.

If upgrading is not possible and duplicate-name detection is not required,
disable it with `.attributes().with_checks(false)` (this does not help
`NsReader` consumers, which have no equivalent opt-out before 0.41.0).

## Which versions are affected by RUSTSEC-2026-0194?

1 open source package ship an affected version, including quick-xml.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `quick-xml` | crates.io | From 0.0.0-0 | 0.41.0 |

## How do I fix RUSTSEC-2026-0194?

Upgrade quick-xml to 0.41.0 or later.

## Is RUSTSEC-2026-0194 being exploited?

There is no known exploitation of RUSTSEC-2026-0194 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for RUSTSEC-2026-0194 and fix it if it is affected.

What it is: RUSTSEC-2026-0194 is a denial of service vulnerability in quick-xml, published on 29 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of RUSTSEC-2026-0194 in the wild and no public exploit code.

Affected packages and fixed versions:
- quick-xml (crates.io): affected from 0.0.0-0; fixed in 0.41.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/RUSTSEC-2026-0194/ (Markdown: https://insights.sbomify.com/RUSTSEC-2026-0194/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/RUSTSEC-2026-0194

---
From sbomify Insights: https://insights.sbomify.com/RUSTSEC-2026-0194/
Summaries are generated and may contain mistakes; the official description above is the record.