Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser Summary ultimate-sitemap-parser version 1.8.0 and earlier parse attacker-controlled XML content using Python's xml.parsers.expat without any restriction on DTD declarations or recursive entity references. An attacker who can serve a malicious sitemap can trigger exponential XML entity expansion (the "Billion Laughs" attack), causing unbounded CPU and memory consumption in the victim process. No authentication, user interaction, or special configuration is required — the vulnerability is exploitable by default through any public-facing use of sitemaptreeforhomepage() or sitemapfromstr(). Details The vulnerable code path begins at the public API entry points and flows to the Expat XML parser without any sanitization: 1. usp/tree.py:42 — sitemaptreeforhomepage(homepageurl) is the primary public entry point. 2. usp/tree.py:133 — sitemapfromstr(content) is the secondary public entry point (also directly reachable from user…
Recommended action: Upgrade to 1.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Gzip Decompression Bomb Bypasses Sitemap Size Limit Summary ultimate-sitemap-parser enforces a 100 MiB size limit on sitemap responses, but applies it only to the compressed bytes received over the network. When a .gz sitemap is fetched, usp/helpers.py:239 calls gziplib.decompress(data) with no output-size cap, allowing an attacker-controlled server to serve a small gzip-compressed payload (~549 KB) that expands to over 120 MiB in process memory. This completely bypasses the declared limit and can exhaust memory or crash any process that calls sitemaptreeforhomepage() against an untrusted site. Details The library declares a maximum sitemap size constant in usp/fetchparse.py:64: Despite the comment saying "uncompressed", this value is passed directly to the HTTP client layer at usp/fetchparse.py:130: The HTTP client (usp/webclient/requestsclient.py:57-58) slices only the raw compressed response bytes: The truncated (but still compressed) bytes are then passed through the pipeline to…
Recommended action: Upgrade to 1.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.