AIKIDO-2026-371823

TL;DR

quick-xml rejects a start tag that repeats an attribute name when iterating BytesStart::attributes() with the default with_checks(true). For each attribute yielded, the iterator compared the new name against every previously seen name with a linear scan, so a tag with N distinct attribute names cost O(N squared) byte comparisons with no bound on N. Parsing untrusted XML that contains a single start tag with a large number of attributes forces CPU time quadratic in the attribute count, pinning a parsing thread for minutes to hours without exhausting memory or crashing, and namespace-aware NsReader reading reaches the same check internally. The fix keeps the linear scan for tags with few attributes and adds an O(1) hash pre-filter above a threshold, making the whole check linear while preserving the reported duplicate positions.