The fast-xml-parser library versions 4.1.3 through 5.3.5 are vulnerable to CWE-776, improper restriction of recursive entity references in DTDs, also known as XML Entity Expansion. This flaw allows an attacker to provide a specially crafted XML input that forces the parser to perform unlimited entity expansion, leading to excessive resource consumption and denial of service by freezing the application. The vulnerability has a CVSS v3.1 base score of 7.5, indicating high severity with network attack vector, low complexity, no privileges or user interaction required, and high impact on availability. The issue is resolved in version 5.3.6. The vendor advisory and Red Hat advisory confirm the denial of service impact and recommend upgrading to the fixed version. A temporary mitigation is to disable entity processing by setting processEntities to false, avoiding DOCTYPE parsing.

An attacker can cause a denial of service by sending a small, specially crafted XML input that triggers unlimited entity expansion in the vulnerable versions of fast-xml-parser. This leads to excessive CPU and memory consumption, freezing the application and making it unavailable for legitimate users. There is no impact on confidentiality or integrity. The vulnerability can be exploited remotely without authentication or user interaction.

Upgrade fast-xml-parser to version 5.3.6 or later, which contains the official fix for this vulnerability. As a workaround, if upgrading is not immediately possible, disable DOCTYPE parsing by setting the processEntities option to false to prevent entity expansion. Note that Red Hat advisories indicate that some mitigations may not meet their criteria for ease of use or stability, so upgrading is the recommended approach.