cve.bz

CWE-776: Improper Restriction of Recursive Entity References in DTDs (Billion Laughs Attack), page 3

Filter

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

What the weakness is: CWE-776 at MITRE. OWASP Top 10: A02:2025 Security Misconfiguration

Related attack patterns (CAPEC): 1
  • CAPEC-197 Exponential Data Expansion Likelihood: High · Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-776, as MITRE names them. Credits.

Ask an AI about CWE-776

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-776: Improper Restriction of Recursive Entity References in DTDs and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/776.html and https://cve.bz/cve/cwe/776?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2008-3281EPSS 2.5%

    libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.

  2. 6.5CVE-2003-1564EPSS 1.6%

    libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large nu…