cve.bz

CWE-776: Improper Restriction of Recursive Entity References in DTDs (Billion Laughs Attack)

Filter

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

What the weakness is: CWE-776 at MITRE. OWASP Top 10: A02:2025 Security Misconfiguration

Related attack patterns (CAPEC): 1
  • CAPEC-197 Exponential Data Expansion Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-776, as MITRE names them. Credits.

Ask an AI about CWE-776

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-776: Improper Restriction of Recursive Entity References in DTDs and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/776.html and https://cve.bz/cve/cwe/776?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. –CVE-2026-119724EPSS 0.2%Unsupported when assigned

    Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a version th…

  2. 8.7CVE-2026-115506EPSS 0.4%

    libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with…

  3. 8.8CVE-2026-108358EPSS 0.6%

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that…

  4. 8.8CVE-2026-108357EPSS 0.5%

    PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate,…

  5. 7.5CVE-2026-108086EPSS 0.4%Unsupported when assigned

    Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing fi…

  6. 6.5CVE-2026-111252EPSS 0.2%

    A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities …

  7. 6.9CVE-2026-74030EPSS 0.4%

    Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy wit…

  8. 7.5CVE-2026-108039EPSS 0.5%

    By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM …

  9. 6.1CVE-2026-92001EPSS 0.6%

    Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fix…

  10. 7.1CVE-2026-54077EPSS 0.4%

    ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integratio…

  11. 5.9CVE-2023-46035EPSS 0.4%

    The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.

  12. 2.2CVE-2026-58234EPSS 0.3%

    SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system res…

  13. 5.7CVE-2026-16180EPSS 0.3%

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 Toolkit could allow an authenticated user to cause a denial-of-service condition due to improp…

  14. 8.7CVE-2026-78681EPSS 0.5%

    NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes …

  15. 8.7CVE-2026-73569EPSS 0.5%

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and pass…

  16. 8.7CVE-2026-3415EPSS 0.5%

    The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplie…

  17. 5.3CVE-2026-14865EPSS 0.4%

    In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion.

  18. 7.5CVE-2026-14979EPSS 0.5%

    IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service…

  19. 8.7CVE-2026-45304EPSS 0.7%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small unt…

  20. 8.2CVE-2026-45133EPSS 0.6%

    Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cau…

  21. 7.1CVE-2026-44018EPSS 0.2%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked secu…

  22. 6.5CVE-2026-12993EPSS 0.5%

    A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING. An attacker with artifact-write permission ca…

  23. 7.5CVE-2026-44020EPSS 0.6%

    Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection…

  24. 7.5CVE-2026-45771EPSS 0.3%

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH's bundled XML parser…

  25. 5.3CVE-2026-23822EPSS 0.3%

    A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consu…

  26. 7.5CVE-2026-31248EPSS 0.3%

    Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML files from .tar.gz archives using etree.fromstring() without disabling entity resolution. An attacker can cr…

  27. 7.1CVE-2026-42212EPSS 0.4%

    SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server t…

  28. 8.7CVE-2026-41673EPSS 0.6%

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.j…

  29. 6.9CVE-2026-40260EPSS 0.4%

    pypdf is a free and open-source pure-python PDF library. In versions prior to 6.10.0, manipulated XMP metadata entity declarations can exhaust RAM. An attacker who exploits this vulnerability can craft a PDF which leads to large memory usa…

  30. 7.5CVE-2026-33116EPSS 2.1%

    Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.

  31. 7.5CVE-2026-26171EPSS 1.8%

    Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

  32. 7.5CVE-2026-33908EPSS 0.5%

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this proces…

  33. 7.5CVE-2026-33036EPSS 0.6%

    fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML …

  34. 7.5CVE-2026-29074EPSS 0.7%

    SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML w…

  35. 4.9CVE-2026-27807EPSS 0.3%

    MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows course instructors to upload YAML files to create/update various entities (e.g., assignment settings). These YAML file…

  36. 7.5CVE-2026-26278EPSS 0.9%

    fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of ent…

  37. 6.5CVE-2025-20369EPSS 0.3%

    In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privilege user that does not hold the "admin" or "power" Splunk roles could perform an…

  38. 4.9CVE-2025-5466EPSS 0.8%

    XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authent…

  39. 9.8CVE-2019-19144EPSS 0.8%

    XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.

  40. 7.5CVE-2025-3225EPSS 0.5%

    An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply …

  41. 5.9CVE-2025-0617EPSS 0.4%

    An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger file parsing containing exponential entity expansions in the consumer process th…

  42. 5.9CVE-2024-43398EPSS 1.2%

    REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXM…

  43. 8.2CVE-2024-28982EPSS 0.4%

    Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.

  44. 5.9CVE-2024-27142EPSS 0.9%

    Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the …

  45. 5.9CVE-2024-27141EPSS 1.1%

    Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the …

  46. 5.5CVE-2022-28652EPSS 0.2%

    ~/.config/apport/settings parsing is vulnerable to "billion laughs" attack

  47. 5.9CVE-2024-1455EPSS 0.8%

    A vulnerability in the langchain-ai/langchain repository allows for a Billion Laughs Attack, a type of XML External Entity (XXE) exploitation. By nesting multiple layers of entities within an XML document, an attacker can cause the XML par…

  48. 7.5CVE-2024-28757EPSS 2.0%

    libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

  49. 5.5CVE-2023-52426EPSS 0.4%

    libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

  50. 7.5CVE-2023-49967EPSS 0.7%

    Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.