CVE-2024-41818

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400CWE-1333

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-418195.4Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbiCVE-2024-41824.3Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statCVE-2024-418206.0Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resCVE-2024-418246.5In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific casesCVE-2024-418255.4In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tabCVE-2024-418264.8In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection pageCVE-2024-418279.8In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expirationCVE-2024-418286.5In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeCVE-2024-418297.5In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connectionCVE-2024-41836.5Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessiCVE-2024-418307.8Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability thCVE-2024-418317.8Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Use After Free vulnerability th
CVE-2024-41818: High severity, CVSS 7.5 | Vulnix