RUSTSEC-2026-0194 (quadratic run time checking a start tag for duplicate
attribute names) and -0195 (unbounded namespace-declaration allocation in
`NsReader`) are both 7.5 denial-of-service defects in quick-xml.
-0195 is not reachable: `NsReader` appears nowhere in the tree. -0194 is,
and on a path that matters — `openpay/crates/op-iso20022/src/codec.rs` calls
`quick_xml:🇩🇪:from_str` on ISO 20022 messages, which arrive from payment
counterparties. Attacker-shaped XML is the normal case there, not the
exception, so a quadratic parse is a real availability vector on payment
ingestion.
Bumped 0.36 -> 0.41.0 in the four lockfiles where the version is ours to
choose: openpay, jouleclaw, mesh, and the l3-jouleclaw example.
Two remain pinned by dependents and cannot be fixed from here:
- openpay also resolves quick-xml 0.37.5 through `open-payments-iso20022
v1.0.10`. That is the same ISO 20022 surface, so this bump hardens our own
deserializer but NOT that library's internal parsing. Closing it needs an
upstream release; it is not closed by this commit.
- smart-byte resolves 0.39.4 through plist -> netdev -> netwatch -> iroh.
That path parses macOS plists, not counterparty XML, so the exposure is
materially lower.
Co-Authored-By: Claude Opus 5 <[email protected]>
031ccb235b