The roxmltree library versions up to 0.21.1 perform attribute and namespace validation in a manner that has quadratic time complexity relative to the number of attributes. Because there is no limit on attribute count, an attacker can create XML documents with extremely large numbers of attributes on a single element. Parsing such documents causes excessive CPU usage, resulting in a denial-of-service condition. This vulnerability is identified as CVE-2026-92987 with a CVSS 4.0 score of 8.7, indicating high severity. No known exploits are reported in the wild. No vendor advisory or patch information is provided in the input data.

Successful exploitation leads to denial of service by consuming excessive CPU resources during XML parsing. This can disrupt availability of applications or services using affected versions of roxmltree. There is no indication of privilege escalation, data disclosure, or integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting or validating XML input size and attribute counts externally to mitigate potential denial-of-service attacks.