Quadratic blowup in Convert::xml2array()

MEDIUM 6.5CVE-2021-41559 · BIT-silverstripe-2021-41559 · GHSA-9fmg-89fx-r33w · Published 28/06/2022 · updated 17/06/2026

In short

CVE-2021-41559 is a MEDIUM (CVSS 6.5) vulnerability affecting silverstripe/framework, silverstripe (silverstripe).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 65.3% of all vulnerabilities.
Fix: update to 4.10.9 or later.

Package	Affected versions	Patched versions
silverstripe/framework Packagist	`≥ 4.0.0, < 4.10.9`	`4.10.9`
silverstripe silverstripe	`< 4.10.9`	`4.10.9`

Description

Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.

NVD description

Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.

References

nvd.nist.gov/vuln/detail/CVE-2021-41559 · ADVISORY
FriendsOfPHP/security-advisories · WEB
silverstripe/silverstripe-framework release · WEB
silverstripe.org/download/security-releases · WEB
silverstripe.org/download/security-releases/cve-2021-41559 · WEB
silverstripe.org/download/security-releases · Not Applicable

More vulnerabilities in silverstripe/framework

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

silverstripe/framework

Packagist

≥ 4.0.0, < 4.10.9

4.10.9

silverstripe

< 4.10.9

4.10.9

Description

Silverstripe silverstripe/framework 4.x until 4.10.9 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.

NVD description

Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.

More vulnerabilities in silverstripe/framework

See all →