Common Weakness Enumeration
CWE-776
AllowedImproper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Abstraction: Base · Status: Draft
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
153 vulnerabilities reference this CWE, most recent first.
GHSA-5QF9-CF9C-HJC6
Vulnerability from github – Published: 2026-06-08 15:33 – Updated: 2026-06-12 19:06
VLAI
Summary
Routinator crashes when encountering maliciously crafted RRDP XML files
Details
When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.15.1"
},
"package": {
"ecosystem": "crates.io",
"name": "routinator"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.15.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-49235"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-755",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-12T19:06:16Z",
"nvd_published_at": "2026-06-08T15:16:48Z",
"severity": "HIGH"
},
"details": "When Routinator encounters a file via RRDP using a specifically crafted Document Type Definition, Routinator crashes.",
"id": "GHSA-5qf9-cf9c-hjc6",
"modified": "2026-06-12T19:06:16Z",
"published": "2026-06-08T15:33:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49235"
},
{
"type": "PACKAGE",
"url": "https://github.com/NLnetLabs/routinator"
},
{
"type": "WEB",
"url": "https://github.com/NLnetLabs/routinator/releases/tag/v0.15.2"
},
{
"type": "WEB",
"url": "https://www.nlnetlabs.nl/downloads/routinator/CVE-2026-49235.txt"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"type": "CVSS_V4"
}
],
"summary": "Routinator crashes when encountering maliciously crafted RRDP XML files"
}
GHSA-5WM2-38Q5-5RXV
Vulnerability from github – Published: 2022-05-14 00:56 – Updated: 2023-09-25 14:35
VLAI
Summary
Several Zend Products Vulnerable to XXE and XEE attacks
Details
Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendframework1"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.12.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendopenid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendrest"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendservice-audioscrobbler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendservice-nirvanix"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendservice-slideshare"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendservice-technorati"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendservice-windowsazure"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendservice-amazon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "zendframework/zendservice-api"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-2683"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-25T14:35:32Z",
"nvd_published_at": "2014-11-16T00:59:00Z",
"severity": "MODERATE"
},
"details": "Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.",
"id": "GHSA-5wm2-38q5-5rxv",
"modified": "2023-09-25T14:35:32Z",
"published": "2022-05-14T00:56:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2683"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20140419041226/http://www.securityfocus.com/bid/66358"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20150523055201/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2014:072/?name=MDVSA-2014:072"
},
{
"type": "WEB",
"url": "http://advisories.mageia.org/MGASA-2014-0151.html"
},
{
"type": "WEB",
"url": "http://framework.zend.com/security/advisory/ZF2014-01"
},
{
"type": "WEB",
"url": "http://seclists.org/oss-sec/2014/q2/0"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2015/dsa-3265"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Several Zend Products Vulnerable to XXE and XEE attacks"
}
GHSA-5X8P-X36C-4GWR
Vulnerability from github – Published: 2022-11-04 12:00 – Updated: 2022-11-05 12:00
VLAI
Details
CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-42745"
],
"database_specific": {
"cwe_ids": [
"CWE-611",
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-03T20:15:00Z",
"severity": "HIGH"
},
"details": "CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.",
"id": "GHSA-5x8p-x36c-4gwr",
"modified": "2022-11-05T12:00:21Z",
"published": "2022-11-04T12:00:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42745"
},
{
"type": "WEB",
"url": "https://candidats.net"
},
{
"type": "WEB",
"url": "https://fluidattacks.com/advisories/jcole"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-62QP-3FXM-9WXF
Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2023-06-09 19:45
VLAI
Summary
Nokogiri vulnerable to DoS while parsing XML documents
Details
Nokogiri gem has Denial of Service via infinite loop when parsing XML documents
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "1.5.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-6460"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-09T19:45:51Z",
"nvd_published_at": "2019-11-05T15:15:00Z",
"severity": "MODERATE"
},
"details": "Nokogiri gem has Denial of Service via infinite loop when parsing XML documents",
"id": "GHSA-62qp-3fxm-9wxf",
"modified": "2023-06-09T19:45:51Z",
"published": "2022-05-05T00:29:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2013-6460"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml"
},
{
"type": "PACKAGE",
"url": "https://github.com/sparklemotion/nokogiri"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Nokogiri vulnerable to DoS while parsing XML documents"
}
GHSA-66WF-G54M-27M7
Vulnerability from github – Published: 2022-05-17 05:30 – Updated: 2024-02-15 21:31
VLAI
Details
Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug IDs CSCtq89842 and CSCtq88547, a similar issue to CVE-2003-1564.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2011-3288"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-10-06T10:55:00Z",
"severity": "HIGH"
},
"details": "Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug IDs CSCtq89842 and CSCtq88547, a similar issue to CVE-2003-1564.",
"id": "GHSA-66wf-g54m-27m7",
"modified": "2024-02-15T21:31:24Z",
"published": "2022-05-17T05:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3288"
},
{
"type": "WEB",
"url": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110928-xcpcupsxml.html"
},
{
"type": "WEB",
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d47.shtml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C4Q-J8WJ-WF2X
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2022-05-24 17:26
VLAI
Details
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
{
"affected": [],
"aliases": [
"CVE-2020-24589"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-21T20:15:00Z",
"severity": "MODERATE"
},
"details": "The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.",
"id": "GHSA-6c4q-j8wj-wf2x",
"modified": "2022-05-24T17:26:20Z",
"published": "2022-05-24T17:26:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24589"
},
{
"type": "WEB",
"url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0742"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6CVG-3R48-6PRG
Vulnerability from github – Published: 2022-04-23 00:03 – Updated: 2022-04-30 00:00
VLAI
Details
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-20464"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-22T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.",
"id": "GHSA-6cvg-3r48-6prg",
"modified": "2022-04-30T00:00:45Z",
"published": "2022-04-23T00:03:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20464"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196813"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220602-0003"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6570957"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6WFM-7HQX-39WG
Vulnerability from github – Published: 2022-04-29 01:28 – Updated: 2024-02-02 15:30
VLAI
Details
libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2003-1564"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2003-12-31T05:00:00Z",
"severity": "HIGH"
},
"details": "libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the \"billion laughs attack.\"",
"id": "GHSA-6wfm-7hqx-39wg",
"modified": "2024-02-02T15:30:25Z",
"published": "2022-04-29T01:28:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1564"
},
{
"type": "WEB",
"url": "http://mail.gnome.org/archives/xml/2008-August/msg00034.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31868"
},
{
"type": "WEB",
"url": "http://www.reddit.com/r/programming/comments/65843/time_to_upgrade_libxml2"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0886.html"
},
{
"type": "WEB",
"url": "http://www.stylusstudio.com/xmldev/200302/post20020.html"
},
{
"type": "WEB",
"url": "http://xmlsoft.org/news.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6WJ9-77WQ-JQ7P
Vulnerability from github – Published: 2022-04-23 00:40 – Updated: 2023-03-06 23:31
VLAI
Summary
Nokogiri is vulnerable to XML External Entity (XXE) attack
Details
Nokogiri before 1.5.4 is vulnerable to XXE attacks.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-6685"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-12T16:55:39Z",
"nvd_published_at": "2020-02-19T15:15:00Z",
"severity": "HIGH"
},
"details": "Nokogiri before 1.5.4 is vulnerable to XXE attacks.",
"id": "GHSA-6wj9-77wq-jq7p",
"modified": "2023-03-06T23:31:46Z",
"published": "2022-04-23T00:40:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6685"
},
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/issues/693"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1178970"
},
{
"type": "PACKAGE",
"url": "https://github.com/sparklemotion/nokogiri"
},
{
"type": "WEB",
"url": "https://nokogiri.org/CHANGELOG.html#154-2012-06-12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Nokogiri is vulnerable to XML External Entity (XXE) attack"
}
GHSA-73CQ-FHP3-8RPW
Vulnerability from github – Published: 2018-10-17 00:04 – Updated: 2021-09-02 19:18
VLAI
Summary
Moderate severity vulnerability that affects org.restlet.jse:org.restlet
Details
Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.restlet.jse:org.restlet"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-1868"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:21:10Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.",
"id": "GHSA-73cq-fhp3-8rpw",
"modified": "2021-09-02T19:18:12Z",
"published": "2018-10-17T00:04:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1868"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91181"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-73cq-fhp3-8rpw"
},
{
"type": "PACKAGE",
"url": "https://github.com/restlet/restlet-framework-java"
},
{
"type": "WEB",
"url": "https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/56940"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Moderate severity vulnerability that affects org.restlet.jse:org.restlet"
}
Mitigation
Operation
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Mitigation
Implementation
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
CAPEC-197: Exponential Data Expansion
An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.