From 3f797af7e4a2e69f2f5aa5305f79960f7e7c5d13 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Sat, 12 Sep 2026 09:39:38 +0100 Subject: Avoid excessive backtracking when parsing unterminated strings --- NEWS | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'NEWS') diff --git a/NEWS b/NEWS index 5ee0c76..fa7fdb7 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,15 @@ +# 1.12.2 + +* Avoid excessive backtracking when parsing an unterminated string with many + escape sequences. The previous behaviour would allow maliciously crafted + documents to cause a denial of service in other implementations of Mammoth. + While the exact test case did not cause the same issue in the Java + implementation, the behaviour has been updated out of an abundance of caution + and for consistency. + + Note that it is still strongly recommended to process untrusted documents in + a separate thread with a timeout to avoid potential similar issues. + # 1.12.1 * Detect and ignore numbering levels that use numStyleLink to refer to -- cgit v1.2.3