CVE-2025-8312: xmldom HTML raw-text closing-tag case-sensitivity causes quadratic DoS

Vulnerability Summary: Output Amplification Due to Case Mismatch in HTML Raw-Text Closing Tags Overview Vulnerability Name: HTML raw-text closing-tag case mismatch causes output amplification CVE ID: CVE-2025-8312 Severity: High (CVSS 4.0 score: 8.7/10) Root Cause: Defect in the case-sensitive search for closing tags in HTML raw-text elements ( , , , ) within the function. When the case of a raw-text element's closing tag does not match its opening tag (e.g., paired with ), the parser repeatedly backtracks during the search, resulting in quadratic output growth. This can lead to CPU and memory exhaustion, potentially causing service disruption (DoS). Affected Component: HTML mode ( ) of Scope of Impact Affected Versions: Fixed Version: Impact: An attacker can generate tens to hundreds of megabytes of output from a very small amount of untrusted HTML input (a few tens of kilobytes), leading to CPU/memory exhaustion or timeouts. Exploitation Conditions: Only requires a MIME type and a closing tag with a case mismatch; no special configuration or authentication is needed. Remediation Fix Method: The raw-text closing-tag search has been changed to be case-insensitive, explicitly handling case-mismatch cases and eliminating quadratic output amplification. Compatibility: The output for well-formed input remains unchanged; the fix is non-breaking and only affects the 0.9.x series. Proof of Concept (POC) Output Amplification Ratio Table: > Note: The same amplification effect also exists for , , and elements.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-8312: xmldom HTML raw-text closing-tag case-sensitivity causes quadratic DoS

More from this source