Avoid excessive backtracking when parsing unterminated strings

1 files changed, 12 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index 5ee0c76..fa7fdb7 100644
--- a/NEWS
+++ b/NEWS
@@ -1,3 +1,15 @@
+# 1.12.2
+
+* Avoid excessive backtracking when parsing an unterminated string with many
+  escape sequences. The previous behaviour would allow maliciously crafted
+  documents to cause a denial of service in other implementations of Mammoth.
+  While the exact test case did not cause the same issue in the Java
+  implementation, the behaviour has been updated out of an abundance of caution
+  and for consistency.
+
+  Note that it is still strongly recommended to process untrusted documents in
+  a separate thread with a timeout to avoid potential similar issues.
+
 # 1.12.1
 
 * Detect and ignore numbering levels that use numStyleLink to refer to