{"cve":"CVE-2019-5442","nvd":{"published":"2019-06-12T16:29:00.300","modified":"2026-06-17T02:37:41.780","status":"Modified","description":"XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-776"],"references":["https://hackerone.com/reports/506791","https://hackerone.com/reports/506791"],"products":["pippo:pippo"],"source":"nvd","synced_at":"2026-10-19T20:57:00.690689396+00:00"},"epss":{"cve":"CVE-2019-5442","score":0.01443,"percentile":0.73241,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hwcx-9p4j-7hwj","url":"https://osv.dev/vulnerability/GHSA-hwcx-9p4j-7hwj","summary":"XML Entity Expansion in Pippo","modified":"2023-11-08T04:01:36.289975Z","packages":[{"ecosystem":"Maven","name":"ro.pippo:pippo-jaxb","purl":"pkg:maven/ro.pippo/pippo-jaxb","ranges":["<=1.12.0"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}