CVE-2021-4249

HIGH

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity...

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.8%
Percentile57th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-404: CWE-404
Related Attack Patterns (CAPEC)
CAPEC-494 TCP Fragmentation
via CWE-404
CAPEC-495 UDP Fragmentation
via CWE-404
CAPEC-496 ICMP Fragmentation
via CWE-404
CAPEC-666 BlueSmacking
via CWE-404
CAPEC-125 Flooding
via CWE-404
Show all 7

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in xml-conduit, specifically in the DOCTYPE Entity Expansion Handler, can lead to an infinite loop due to improper handling of XML entities, allowing for remote attacks.

BSID: BS-2022-GLOBAL-063723-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-4249?
A vulnerability in xml-conduit, specifically in the DOCTYPE Entity Expansion Handler, can lead to an infinite loop due to improper handling of XML entities, allowing for remote attacks.
What is the CVSS score for CVE-2021-4249?
CVE-2021-4249 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS: 0.8%.
Is CVE-2021-4249 actively exploited?
No confirmed active exploitation of CVE-2021-4249 as of 2026-09-25.
How do I remediate CVE-2021-4249?
Priority: HIGH. Advisory: https://hackage.haskell.org/package/xml-conduit-1.9.1.0 PSIRT: [email protected]
What systems are affected by CVE-2021-4249?
CVE-2021-4249 affects Haskell Xml-Conduit.
Vulnerability Details
CVE IDCVE-2021-4249
BSIDBS-2022-GLOBAL-063723-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published2022-12-18
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
CWE-404
SourceNVD
Official Description

A vulnerability was found in xml-conduit. It has been classified as problematic. Affected is an unknown function of the file xml-conduit/src/Text/XML/Stream/Parse.hs of the component DOCTYPE Entity Expansion Handler. The manipulation leads to infinite loop. It is possible to launch the attack remotely. Upgrading to version 1.9.1.0 is able to address this issue. The name of the patch is 4be1021791dcdee8b164d239433a2043dc0939ea. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216204.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack can be launched remotely by sending specially crafted XML data to a system using the affected version of xml-conduit, potentially leading to a denial of service.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Haskell Xml-Conduit < 1.9.1.0
Remediation
View Vendor Advisory →

Remediation Priority: HIGH

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1397 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash69876e63e66f3c3a480331956d476b337967e1bafc196de8ef5e6a13804c228ad9790dc2cb643a4f1963b17bad1ee93410f4fd55e2f710e11daa275795eca281
Related CVEs affecting Haskell
CVE-2026-40470 9.9 A critical XSS vulnerability affected hackage-server and hackage.haskell.org.... CVE-2024-3566 9.8 A command inject vulnerability allows an attacker to perform command injectio... CVE-2013-0243 7.4 haskell-tls-extra before 0.6.1 has Basic Constraints attribute vulnerability ... CVE-2022-3433 6.5 The aeson library is not safe to use to consume untrusted JSON input. A remot...
View all Haskell CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →