cve.bz

CAPEC-197

Exponential Data Expansion

Medium severityHigh likelihoodDetailed pattern

An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.

On this page

Ask an AI about this attack pattern

ChatGPTClaudeGoogle AI Mode

Show the promptExplain the attack pattern CAPEC-197: Exponential Data Expansion: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/197.html and https://cve.bz/cve/capec/197?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

  1. Explore

    The attacker looks for a way in.

    1. [Survey the target] An adversary determines the input data stream that is being processed by a data parser that supports using subsitituion on the victim's side.

      2 techniques
      • Use an automated tool to record all instances of URLs to process requests.
      • Use a browser to manually explore the website and analyze how the application processes requests.

  2. Experiment

    They probe what they found.

    1. [Craft malicious payload] The adversary crafts a malicious message containing nested exponential expansion that completely uses up available server resources. See the "Example Instances" section for details on how to craft this malicious payload.

  3. Exploit

    They carry out the attack.

    1. [Send the message] Send the malicious crafted message to the target URL.

Prerequisites

  • This type of attack requires that the target must receive input but either fail to provide an upper limit for entity expansion or provide a limit that is so large that it does not preclude significant resource consumption.

Skills required

  • Low skill

    Ability to craft nested data expansion messages.

Resources required

  • None: No specialized resources are required to execute this type of attack.

Consequences

What a successful attack can lead to
ImpactAffectsNote
Unreliable Execution, Resource ConsumptionAvailabilityDenial of Service

Mitigations

  • Design: Use libraries and templates that minimize unfiltered input. Use methods that limit entity expansion and throw exceptions on attempted entity expansion.

  • Implementation: For XML based data - disable altogether the use of inline DTD schemas when parsing XML objects. If a DTD must be used, normalize, filter and use an allowlist and parse with methods and routines that will detect entity expansion from untrusted sources.

Weaknesses it exploits

  • CWE-770 Allocation of Resources Without Limits or Throttling
  • CWE-776 Improper Restriction of Recursive Entity References in DTDs

Recent CVEs with these weaknesses

  1. 1.0CVE-2026-124038

    An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.0 allows an attacker who has a valid technician account and controls or impersonates the camera being set up to crash the app, on…

  2. –CVE-2026-86531

    The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files it creates for multipart parts. A remote unauthenticated attacker can cause excessive mem…

  3. 7.0CVE-2026-114359

    Eclipse Kura downloads deployment packages (DPs) from a remote URL without any limit on the size of the data it receives. A malicious or compromised HTTP(S) server, or an attacker able to tamper with a plain-HTTP download, can stream an ar…

  4. 8.7CVE-2026-60040

    An unauthenticated remote attacker can perform a DoS in the backends backup creation function. This can result in a total loss of availability.

  5. 8.7CVE-2026-123817

    AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader retains one bytes object for each transport read while reassembling an incomplete frame. A malicious peer can split a fra…

  6. 6.8CVE-2026-125205

    FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file …

  7. 5.7CVE-2026-125186

    FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in the dts2pts bitstream filter that allows attackers to exhaust CPU through unbounded per-packet POC node allocation. Attackers can supply a crafted H.264 pa…

  8. 6.8CVE-2026-125180

    FFmpeg 8.1 through 9.0.2 contains a memory exhaustion vulnerability in the libavcodec/exif.c parser that allows attackers to amplify allocations by pointing many IFD entries at overlapping payloads. Attackers can embed a small crafted EXIF…

The newest records naming one of them. Each weakness's page lists them all.

Part of
  • CAPEC-230 Serialized Data with Nested Payloads

Examples

The most common example of this type of attack is the "many laughs" attack (sometimes called the 'billion lau…

The most common example of this type of attack is the "many laughs" attack (sometimes called the 'billion laughs' attack). For example:

<?xml version="1.0"?>
<!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
  <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
  <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
  <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6">
  <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
  <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">

]>
<lolz>&lol9;</lolz>

This is well formed and valid XML according to the DTD. Each entity increases the number entities by a factor of 10. The line of XML containing lol9; expands out exponentially to a message with 10^9 entities. A small message of a few KBs in size can easily be expanded into a few GB of memory in the parser. By including 3 more entities similar to the lol9 entity in the above code to the DTD, the program could expand out over a TB as there will now be 10^12 entities. Depending on the robustness of the target machine, this can lead to resource depletion, application crash, or even the execution of arbitrary code through a buffer overflow.

This example is similar, but uses YAML. This was used to attack Kubernetes [REF-686]

This example is similar, but uses YAML. This was used to attack Kubernetes [REF-686]

a:&a ["lol","lol","lol","lol","lol","lol","lol","lol","lol"]
b:&b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
c:&c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
d:&d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
e:&e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
f:&f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
g:&g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
h:&h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
i:&i [*h,*h,*h,*h,*h,*h,*h,*h,*h]

MITRE's words, unchanged: CAPEC-197 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.