Security: quick-xml <0.41 DoS (RUSTSEC-2026-0194/0195) — accepted, transitive via object_store

[devitway]

Summary

cargo audit reports two HIGH advisories against quick-xml 0.39.3:

• RUSTSEC-2026-0194 — quadratic run time on duplicate start-tag attribute names (7.5)
• RUSTSEC-2026-0195 — unbounded namespace-declaration allocation in NsReader → memory-exhaustion DoS (7.5)

Fix: quick-xml >= 0.41.0.

Why it is currently accepted (ignored in CI)

• Transitive, single source: quick-xml is pulled only by object_store (S3 XML response parsing). NORA has no direct dependency.
• No upstream fix yet: the latest object_store (0.14.0) still pins quick-xml ^0.40.1 (< 0.41), which is also affected (the fix is >= 0.41.0). There is no object_store release that resolves this, so it cannot be fixed by a version bump today. A [patch] to 0.41 would not compile against object_store's 0.40-targeted code.
• Low real exposure: the XML parsed by this path comes from the operator's configured S3 backend (their own MinIO / S3 / Ceph), not from attacker-controlled input. Triggering the DoS requires control of the storage backend's responses (or a MITM on an untrusted-transport endpoint) — not an externally reachable vector in NORA's threat model. Not zero, but not remotely exploitable.

Handling

Ignored in the Security CI job with a documenting comment (same pattern as RUSTSEC-2025-0119 / -2023-0071).

Upgrade path (close condition)

Remove the two --ignore flags once object_store ships a release using quick-xml >= 0.41.0, then cargo update -p object_store.