AIKIDO-2026-173392

TL;DR

The XML pull reader and the serde deserializer track nesting depth and namespace scope without effective bounds when handling untrusted input. Deeply nested elements overflow the internal u16 namespace-depth counter and drive the recursive serde deserializer into native call-stack exhaustion, while some malformed inputs let attribute iteration read past the end of the buffer. The fix returns TooDeeplyNested errors, enforces a configurable deserializer recursion limit, and makes attribute iteration stop safely at the buffer boundary.