AIKIDO-2026-238437

TL;DR

The DocLang deserializer parses XML input into a document object model without enforcing limits on input byte size, nesting depth, or element count. An attacker who supplies a crafted DocLang document with a very large body, deeply nested structure, or an excessive number of elements can force excessive memory and CPU consumption during deserialize_str. Applications that deserialize untrusted DocLang input can be driven into resource exhaustion and denial of service. The fix caps input bytes before parsing and bounds nesting depth and element count after DOM construction, rejecting inputs that exceed configurable budgets.