AIKIDO-2026-176217

TL;DR

quick-xml resolves XML namespaces by calling NamespaceResolver::push for every start or empty element in NsReader before the event is returned to the caller. push allocates one namespace binding, plus prefix and value bytes, for every xmlns or xmlns:* declaration on the tag with no upper bound. A start tag carrying a large number of namespace declarations forces unbounded heap allocation that the consumer cannot limit, letting untrusted input exhaust memory and crash the process. The fix caps declarations per element at a configurable default of 256 and returns a TooManyDeclarations error instead of allocating past the limit.