Common Weakness Enumeration
CWE-776
AllowedImproper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Abstraction: Base · Status: Draft
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
165 vulnerabilities reference this CWE, most recent first.
GHSA-62QP-3FXM-9WXF
Vulnerability from github – Published: 2022-05-05 00:29 – Updated: 2023-06-09 19:45
VLAI
Summary
Nokogiri vulnerable to DoS while parsing XML documents
Details
Nokogiri gem has Denial of Service via infinite loop when parsing XML documents
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "1.5.0"
},
{
"fixed": "1.5.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-6460"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2023-06-09T19:45:51Z",
"nvd_published_at": "2019-11-05T15:15:00Z",
"severity": "MODERATE"
},
"details": "Nokogiri gem has Denial of Service via infinite loop when parsing XML documents",
"id": "GHSA-62qp-3fxm-9wxf",
"modified": "2023-06-09T19:45:51Z",
"published": "2022-05-05T00:29:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2013-6460"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90058"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2013-6460.yml"
},
{
"type": "PACKAGE",
"url": "https://github.com/sparklemotion/nokogiri"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2013-6460"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200229074427/https://www.securityfocus.com/bid/64513"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/12/27/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Nokogiri vulnerable to DoS while parsing XML documents"
}
GHSA-66WF-G54M-27M7
Vulnerability from github – Published: 2022-05-17 05:30 – Updated: 2024-02-15 21:31
VLAI
Details
Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug IDs CSCtq89842 and CSCtq88547, a similar issue to CVE-2003-1564.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2011-3288"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-10-06T10:55:00Z",
"severity": "HIGH"
},
"details": "Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug IDs CSCtq89842 and CSCtq88547, a similar issue to CVE-2003-1564.",
"id": "GHSA-66wf-g54m-27m7",
"modified": "2024-02-15T21:31:24Z",
"published": "2022-05-17T05:30:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3288"
},
{
"type": "WEB",
"url": "https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-20110928-xcpcupsxml.html"
},
{
"type": "WEB",
"url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b95d47.shtml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C4Q-J8WJ-WF2X
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2022-05-24 17:26
VLAI
Details
The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.
{
"affected": [],
"aliases": [
"CVE-2020-24589"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-21T20:15:00Z",
"severity": "MODERATE"
},
"details": "The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks.",
"id": "GHSA-6c4q-j8wj-wf2x",
"modified": "2022-05-24T17:26:20Z",
"published": "2022-05-24T17:26:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24589"
},
{
"type": "WEB",
"url": "https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0742"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6CVG-3R48-6PRG
Vulnerability from github – Published: 2022-04-23 00:03 – Updated: 2022-04-30 00:00
VLAI
Details
IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-20464"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-22T17:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.",
"id": "GHSA-6cvg-3r48-6prg",
"modified": "2022-04-30T00:00:45Z",
"published": "2022-04-23T00:03:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20464"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/196813"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20220602-0003"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6570957"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6WFM-7HQX-39WG
Vulnerability from github – Published: 2022-04-29 01:28 – Updated: 2024-02-02 15:30
VLAI
Details
libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2003-1564"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2003-12-31T05:00:00Z",
"severity": "HIGH"
},
"details": "libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the \"billion laughs attack.\"",
"id": "GHSA-6wfm-7hqx-39wg",
"modified": "2024-02-02T15:30:25Z",
"published": "2022-04-29T01:28:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1564"
},
{
"type": "WEB",
"url": "http://mail.gnome.org/archives/xml/2008-August/msg00034.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31868"
},
{
"type": "WEB",
"url": "http://www.reddit.com/r/programming/comments/65843/time_to_upgrade_libxml2"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0886.html"
},
{
"type": "WEB",
"url": "http://www.stylusstudio.com/xmldev/200302/post20020.html"
},
{
"type": "WEB",
"url": "http://xmlsoft.org/news.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6WJ9-77WQ-JQ7P
Vulnerability from github – Published: 2022-04-23 00:40 – Updated: 2023-03-06 23:31
VLAI
Summary
Nokogiri is vulnerable to XML External Entity (XXE) attack
Details
Nokogiri before 1.5.4 is vulnerable to XXE attacks.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "nokogiri"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-6685"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2022-09-12T16:55:39Z",
"nvd_published_at": "2020-02-19T15:15:00Z",
"severity": "HIGH"
},
"details": "Nokogiri before 1.5.4 is vulnerable to XXE attacks.",
"id": "GHSA-6wj9-77wq-jq7p",
"modified": "2023-03-06T23:31:46Z",
"published": "2022-04-23T00:40:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6685"
},
{
"type": "WEB",
"url": "https://github.com/sparklemotion/nokogiri/issues/693"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1178970"
},
{
"type": "PACKAGE",
"url": "https://github.com/sparklemotion/nokogiri"
},
{
"type": "WEB",
"url": "https://nokogiri.org/CHANGELOG.html#154-2012-06-12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Nokogiri is vulnerable to XML External Entity (XXE) attack"
}
GHSA-73CQ-FHP3-8RPW
Vulnerability from github – Published: 2018-10-17 00:04 – Updated: 2021-09-02 19:18
VLAI
Summary
Moderate severity vulnerability that affects org.restlet.jse:org.restlet
Details
Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.restlet.jse:org.restlet"
},
"ranges": [
{
"events": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-1868"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:21:10Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.",
"id": "GHSA-73cq-fhp3-8rpw",
"modified": "2021-09-02T19:18:12Z",
"published": "2018-10-17T00:04:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-1868"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/91181"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-73cq-fhp3-8rpw"
},
{
"type": "PACKAGE",
"url": "https://github.com/restlet/restlet-framework-java"
},
{
"type": "WEB",
"url": "https://github.com/restlet/restlet-framework-java/wiki/XEE-security-enhancements"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/56940"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Moderate severity vulnerability that affects org.restlet.jse:org.restlet"
}
GHSA-748J-WM96-4WH5
Vulnerability from github – Published: 2026-06-26 00:32 – Updated: 2026-08-25 15:32
VLAI
Details
A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-12993"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-26T00:16:50Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant) that cause CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.",
"id": "GHSA-748j-wm96-4wh5",
"modified": "2026-08-25T15:32:42Z",
"published": "2026-06-26T00:32:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12993"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:59360"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-12993"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491692"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-74FP-R6JW-H4MP
Vulnerability from github – Published: 2023-02-08 00:35 – Updated: 2024-05-20 21:45
VLAI
Summary
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing
Details
CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable.
When creating a ConfigMap object which has recursive references contained in it, excessive CPU usage can occur. This appears to be an instance of a "Billion Laughs" attack which is quite well known as an XML parsing issue.
Applying this manifest to a cluster causes the client to hang for some time with considerable CPU usage.
apiVersion: v1
data:
a: &a ["web","web","web","web","web","web","web","web","web"]
b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
kind: ConfigMap
metadata:
name: yaml-bomb
namespace: default
Specific Go Packages Affected
- k8s.io/apimachinery/pkg/runtime/serializer/json
- k8s.io/apimachinery/pkg/util/json
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/apimachinery"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20190927203648-9ce6eca90e73"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-08T00:35:27Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. \n\nWhen creating a ConfigMap object which has recursive references contained in it, excessive CPU usage can occur. This appears to be an instance of a \"Billion Laughs\" attack which is quite well known as an XML parsing issue.\n\nApplying this manifest to a cluster causes the client to hang for some time with considerable CPU usage.\n\n```yaml\napiVersion: v1\ndata:\n a: \u0026a [\"web\",\"web\",\"web\",\"web\",\"web\",\"web\",\"web\",\"web\",\"web\"]\n b: \u0026b [*a,*a,*a,*a,*a,*a,*a,*a,*a]\n c: \u0026c [*b,*b,*b,*b,*b,*b,*b,*b,*b]\n d: \u0026d [*c,*c,*c,*c,*c,*c,*c,*c,*c]\n e: \u0026e [*d,*d,*d,*d,*d,*d,*d,*d,*d]\n f: \u0026f [*e,*e,*e,*e,*e,*e,*e,*e,*e]\n g: \u0026g [*f,*f,*f,*f,*f,*f,*f,*f,*f]\n h: \u0026h [*g,*g,*g,*g,*g,*g,*g,*g,*g]\n i: \u0026i [*h,*h,*h,*h,*h,*h,*h,*h,*h]\nkind: ConfigMap\nmetadata:\n name: yaml-bomb\n namespace: default\n```\n### Specific Go Packages Affected\n- k8s.io/apimachinery/pkg/runtime/serializer/json\n- k8s.io/apimachinery/pkg/util/json\n",
"id": "GHSA-74fp-r6jw-h4mp",
"modified": "2024-05-20T21:45:20Z",
"published": "2023-02-08T00:35:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11253"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/83253"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/83261"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-pmqp-h87c-mr78"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/kubernetes"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-announce/c/jk8polzSUxs"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2022-0965"
},
{
"type": "WEB",
"url": "https://stackoverflow.com/questions/58129150/security-yaml-bomb-user-can-restart-kube-api-by-sending-configmap"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing"
}
GHSA-78VV-QJ73-H9M5
Vulnerability from github – Published: 2022-05-13 01:14 – Updated: 2022-07-01 16:57
VLAI
Summary
Improper Restriction of Recursive Entity References in DTDs in Apache POI
Details
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Severity
5.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.poi:poi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-5644"
],
"database_specific": {
"cwe_ids": [
"CWE-776"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-01T16:57:07Z",
"nvd_published_at": "2017-03-24T14:59:00Z",
"severity": "MODERATE"
},
"details": "Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.",
"id": "GHSA-78vv-qj73-h9m5",
"modified": "2022-07-01T16:57:07Z",
"published": "2022-05-13T01:14:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5644"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2020.html"
},
{
"type": "WEB",
"url": "http://poi.apache.org/#20+March+2017+-+CVE-2017-5644+-+Possible+DOS+%28Denial+of+Service%29+in+Apache+POI+versions+prior+to+3.15"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96983"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Restriction of Recursive Entity References in DTDs in Apache POI"
}
Mitigation
Operation
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Mitigation
Implementation
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
CAPEC-197: Exponential Data Expansion
An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.