CVE-2023-34411: 
Rust vulnerability analysis and mitigation

The xml-rs crate before version 0.8.14 for Rust and Crab contains a denial of service (DoS) vulnerability that allows attackers to cause a panic via an invalid <!> token (such as <!DOCTYPEs/%<!A nesting) in XML input. The vulnerability was discovered and disclosed in June 2023 (NVD).

The vulnerability exists in the XML parser's handling of DOCTYPE declarations and markup declarations. When processing certain malformed XML inputs containing invalid <!> tokens or nested DOCTYPE declarations, the parser enters an unreachable state that triggers a panic instead of properly handling the error condition (GitHub Commit).

A successful exploitation of this vulnerability results in a denial of service condition by causing the application to panic when processing maliciously crafted XML input. This affects applications using the vulnerable versions of the xml-rs crate for XML parsing.

Users should upgrade to xml-rs version 0.8.14 or later, which includes fixes for the vulnerability. The patch prevents the panic condition by properly handling invalid markup declarations and DOCTYPE tokens (GitHub PR).