The xml-rs crate before 0.8.14 for Rust and Crab allows a denial of service (panic) via an invalid <! token (such as <!DOCTYPEs/%<!A nesting) in an XML document.
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.01162·Published 2023-06-05·Fixed in 0.8.14CWE-611