[MEDIUM] CVE-2021-41559: Quadratic blowup in Convert::xml2array()

PKSA-9b8c-khwh-k6t3 CVE-2021-41559 GHSA-9fmg-89fx-r33w

Affected package: silverstripe/framework

Affected version: >=4.0.0,<4.10.9

Reported by:
GitHub, FriendsOfPHP/security-advisories