Read the docs
TI-2019-11642 Aliases CVE-2019-15542GHSA-5hp8-35wj-m525

An issue was discovered in the ammonia crate before 2.1.0 for Rust.

Priority LOW 36CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

An issue was discovered in the ammonia crate before 2.1.0 for Rust. There is uncontrolled recursion during HTML DOM tree serialization.

Why it matters now

EPSS 0.01411 72nd percentileScored 2026-11-07
Fix Fixed ammonia (crates.io): 2.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—ammonia (crates.io)before 2.1.02.1.0Patch availableGHSA-5hp8-35wj-m525
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • ammonia (crates.io) Vendor— Affected before 2.1.0 Fixed in 2.1.0 Patch available GHSA-5hp8-35wj-m525

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ammonia_project:ammonia:*:*:*:*:*:*:*:*before 2.1.0VulnerableAmmonia Project
  • cpe:2.3:a:ammonia_project:ammonia:*:*:*:*:*:*:*:* Versions before 2.1.0 Vulnerable ·Ammonia Project

Remediation

  • Fix · GHSA-5hp8-35wj-m525 ammonia (crates.io) Fixed in 2.1.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-15542
  2. 2026-10-03 Alias added: GHSA-5hp8-35wj-m525

References

Advisory 2

Other 2

  • TI-2021-15870 An issue was discovered in the ammonia crate before 3.1.0 for Rust. CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences