AIKIDO-2026-628697

TL;DR

The XML parser in ext/ox/parse.c reads DOCTYPE prolog content through the recursive read_delimited function with no length or depth limit. Parsing an excessively long or deeply nested DOCTYPE drives unbounded recursion until the interpreter reaches a stack-too-deep condition. An attacker who can submit crafted XML to an application that parses it with Ox can exhaust the stack and abort parsing, causing a denial of service. The fix introduces a MAX_PROLOG cap and raises a prolog (doctype) too long error before the stack is exhausted.