Common Weakness Enumeration
CWE-776
AllowedImproper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Abstraction: Base · Status: Draft
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
165 vulnerabilities reference this CWE, most recent first.
GHSA-V2MW-X6G2-24JF
Vulnerability from github – Published: 2026-10-09 12:31 – Updated: 2026-10-15 18:31
VLAI
Details
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 × maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties. Users are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2026-108039"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-09T11:17:02Z",
"severity": "HIGH"
},
"details": "By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for example SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: the maximum element count is 100 \u00d7 maxChildElements (5,000,000 by default), and the maximum document size is 256M characters. Applications that process larger documents can raise the limits with the org.apache.cxf.stax.maxElementCount and org.apache.cxf.stax.maxXMLCharacters properties.\nUsers are recommended to upgrade to versions 4.2.4 or 4.1.9 or 3.6.13, which fix this issue.",
"id": "GHSA-v2mw-x6g2-24jf",
"modified": "2026-10-15T18:31:43Z",
"published": "2026-10-09T12:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108039"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/ms2gbpof609o0v1bjlzb1rn7fwh61l1j"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/10/09/14"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VMWR-MC7X-5VC3
Vulnerability from github – Published: 2024-08-22 16:40 – Updated: 2025-11-03 22:47
VLAI
Summary
REXML denial of service vulnerability
Details
Impact
The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes.
If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected.
Patches
The REXML gem 3.3.6 or later include the patch to fix the vulnerability.
Workarounds
Don't parse untrusted XMLs with tree parser API.
References
- https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org
Severity
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "rexml"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.3.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-43398"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2024-08-22T16:40:46Z",
"nvd_published_at": "2024-08-22T15:15:16Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThe REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes.\n\nIf you need to parse untrusted XMLs with tree parser API like `REXML::Document.new`, you may be impacted to this vulnerability. If you use other parser APIs such as stream parser API and SAX2 parser API, this vulnerability is not affected.\n\n### Patches\n\nThe REXML gem 3.3.6 or later include the patch to fix the vulnerability.\n\n### Workarounds\n\nDon\u0027t parse untrusted XMLs with tree parser API.\n\n### References\n\n* https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398/ : An announce on www.ruby-lang.org",
"id": "GHSA-vmwr-mc7x-5vc3",
"modified": "2025-11-03T22:47:47Z",
"published": "2024-08-22T16:40:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/security/advisories/GHSA-vmwr-mc7x-5vc3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43398"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/commit/7cb5eaeb221c322b9912f724183294d8ce96bae3"
},
{
"type": "PACKAGE",
"url": "https://github.com/ruby/rexml"
},
{
"type": "WEB",
"url": "https://github.com/ruby/rexml/releases/tag/v3.3.6"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rexml/CVE-2024-43398.yml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00011.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250103-0006"
},
{
"type": "WEB",
"url": "https://www.ruby-lang.org/en/news/2024/08/22/dos-rexml-cve-2024-43398"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "REXML denial of service vulnerability"
}
GHSA-W42R-MRX7-C633
Vulnerability from github – Published: 2025-07-07 12:30 – Updated: 2025-07-07 23:59
VLAI
Summary
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser
Details
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting the Papers Loaders package before version 0.3.2 (in llama-index v0.10.0 and above through v0.12.29). This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS) by exhausting system memory and potentially causing a system crash. The issue is resolved in version 0.3.2 (in llama-index 0.12.29).
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "llama-index-readers-papers"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.3.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-3225"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-07T23:59:01Z",
"nvd_published_at": "2025-07-07T10:15:27Z",
"severity": "HIGH"
},
"details": "An XML Entity Expansion vulnerability, also known as a \u0027billion laughs\u0027 attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting the Papers Loaders package before version 0.3.2 (in llama-index v0.10.0 and above through v0.12.29). This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS) by exhausting system memory and potentially causing a system crash. The issue is resolved in version 0.3.2 (in llama-index 0.12.29).",
"id": "GHSA-w42r-mrx7-c633",
"modified": "2025-07-07T23:59:01Z",
"published": "2025-07-07T12:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3225"
},
{
"type": "WEB",
"url": "https://github.com/run-llama/llama_index/commit/4f6ee062b19212106a2632af9c9521fc7f0a3584"
},
{
"type": "PACKAGE",
"url": "https://github.com/run-llama/llama_index"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/e33c0699-e9a2-49aa-837b-5363205637a2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser"
}
GHSA-W4WG-C34C-JF6J
Vulnerability from github – Published: 2025-08-12 15:31 – Updated: 2025-08-12 15:31
VLAI
Details
XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-5466"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-12T15:15:31Z",
"severity": "MODERATE"
},
"details": "XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service",
"id": "GHSA-w4wg-c34c-jf6j",
"modified": "2025-08-12T15:31:20Z",
"published": "2025-08-12T15:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5466"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W545-WJM2-RF4H
Vulnerability from github – Published: 2026-07-17 21:31 – Updated: 2026-07-17 21:31
VLAI
Details
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-14979"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-17T20:17:15Z",
"severity": "MODERATE"
},
"details": "IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper handling of XML entity expansion.",
"id": "GHSA-w545-wjm2-rf4h",
"modified": "2026-07-17T21:31:43Z",
"published": "2026-07-17T21:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14979"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7279963"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-WCGR-63G6-PJ93
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2026-10-14 12:31
VLAI
Details
A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-3541"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-09T17:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in libxml2. Exponential entity expansion attack its possible bypassing all existing protection mechanisms and leading to denial of service.",
"id": "GHSA-wcgr-63g6-pj93",
"modified": "2026-10-14T12:31:20Z",
"published": "2022-05-24T19:07:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3541"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1950515"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210805-0007"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WHF4-FPJ8-PGG8
Vulnerability from github – Published: 2024-06-07 21:31 – Updated: 2025-03-31 13:36
VLAI
Summary
ebookmeta XML External Entity vulnerability
Details
An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.
Severity
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ebookmeta"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-36827"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2024-06-07T21:54:40Z",
"nvd_published_at": "2024-06-07T19:15:24Z",
"severity": "HIGH"
},
"details": "An XML External Entity (XXE) vulnerability in the `ebookmeta.get_metadata` function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service (DoS) via crafted XML input.",
"id": "GHSA-whf4-fpj8-pgg8",
"modified": "2025-03-31T13:36:20Z",
"published": "2024-06-07T21:31:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-36827"
},
{
"type": "WEB",
"url": "https://github.com/dnkorpushov/ebookmeta/issues/16#issue-2317712335"
},
{
"type": "PACKAGE",
"url": "https://github.com/dnkorpushov/ebookmeta"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ebookmeta/PYSEC-2024-76.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ebookmeta XML External Entity vulnerability"
}
GHSA-WQPF-2J2M-Q8Q9
Vulnerability from github – Published: 2022-05-24 17:24 – Updated: 2022-05-24 17:24
VLAI
Details
IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 179156.
{
"affected": [],
"aliases": [
"CVE-2020-4377"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-03T13:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Anaytics 11.0 and 11.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 179156.",
"id": "GHSA-wqpf-2j2m-q8q9",
"modified": "2022-05-24T17:24:53Z",
"published": "2022-05-24T17:24:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4377"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/179156"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6252853"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-X6RX-7HMF-R792
Vulnerability from github – Published: 2022-05-24 17:15 – Updated: 2024-04-04 02:49
VLAI
Details
InstallBuilder AutoUpdate tool and regular installers enabling built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2020-3946"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-04-20T20:15:00Z",
"severity": "HIGH"
},
"details": "InstallBuilder AutoUpdate tool and regular installers enabling \u003ccheckForUpdates\u003e built with versions earlier than 19.11 are vulnerable to Billion laughs attack (denial-of-service).",
"id": "GHSA-x6rx-7hmf-r792",
"modified": "2024-04-04T02:49:57Z",
"published": "2022-05-24T17:15:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-3946"
},
{
"type": "WEB",
"url": "https://blog.installbuilder.com/2019/12/configure-autoupdate-project-settings.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X9C5-C5MJ-WJJX
Vulnerability from github – Published: 2022-05-01 23:58 – Updated: 2025-04-09 03:57
VLAI
Details
libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2008-3281"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-08-27T20:41:00Z",
"severity": "MODERATE"
},
"details": "libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.",
"id": "GHSA-x9c5-c5mj-wjjx",
"modified": "2025-04-09T03:57:49Z",
"published": "2022-05-01T23:58:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3281"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=458086"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6496"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9812"
},
{
"type": "WEB",
"url": "https://rhn.redhat.com/errata/RHSA-2008-0836.html"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/644-1"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00261.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00347.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/Jun/msg00005.html"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2009/jun/msg00002.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html"
},
{
"type": "WEB",
"url": "http://lists.vmware.com/pipermail/security-announce/2008/000039.html"
},
{
"type": "WEB",
"url": "http://mail.gnome.org/archives/xml/2008-August/msg00034.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31558"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31566"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31590"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31728"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31748"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31855"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31982"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32488"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32807"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32974"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35379"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200812-06.xml"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3613"
},
{
"type": "WEB",
"url": "http://support.apple.com/kb/HT3639"
},
{
"type": "WEB",
"url": "http://svn.gnome.org/viewvc/libxml2?view=revision\u0026revision=3772"
},
{
"type": "WEB",
"url": "http://wiki.rpath.com/Advisories:rPSA-2008-0325"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2008/dsa-1631"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:180"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:192"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/497962/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30783"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1020728"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/usn-640-1"
},
{
"type": "WEB",
"url": "http://www.vmware.com/security/advisories/VMSA-2008-0017.html"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2419"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2843"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/2971"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1522"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/1621"
},
{
"type": "WEB",
"url": "http://xmlsoft.org/news.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Operation
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Mitigation
Implementation
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
CAPEC-197: Exponential Data Expansion
An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.