From dc49225425c2c07de0a6dc3529f2386c82a032b4 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Sat, 12 Sep 2026 09:29:13 +0100 Subject: Avoid excessive backtracking when parsing unterminated strings --- NEWS | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'NEWS') diff --git a/NEWS b/NEWS index 1206dac..77f348b 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,12 @@ +# 1.12.3 + +* Avoid excessive backtracking when parsing an unterminated string with many + escape sequences. The previous behaviour would allow maliciously crafted + documents to cause a denial of service. + + Note that it is still strongly recommended to process untrusted documents in + a separate thread with a timeout to avoid potential similar issues. + # 1.12.2 * Avoid prototype pollution when reading the styles defined in a document. This -- cgit v1.2.3