Weaknesses of type CWE-776

45 results

Expansão de Entidades XML (XML Entity Expansion)

Fraqueza que ocorre quando um parser XML processa entidades externas ou recursivas sem validação, permitindo que um atacante defina entidades que se expandem exponencialmente e consumam recursos da aplicação. O risco é negação de serviço (DoS) ou, em casos piores, acesso a arquivos sensíveis do servidor.

Example

Um atacante envia um XML com entidades aninhadas que se expandem recursivamente (ataque Billion Laughs): quando o servidor processa, a entidade `&lol;` contém 10 cópias de `&lol2;`, que contém 10 cópias de `&lol3;`, etc. Isso explode para bilhões de caracteres, travando o parser e o serviço.

How to mitigate

Configure o parser XML para desabilitar DTDs (Document Type Definitions) e entidades externas; use bibliotecas com validação estrita; implemente limites de tamanho e tempo de processamento para documentos XML; valide e sanitize entrada XML antes do parsing.

CVE-2019-5427—c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursiEPSS 4.9%CVE-2022-0217—It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsEPSS 4.7%CVE-2020-5227MEDIUMFeedgen Vulnerable to XML Denial of Service AttacksEPSS 2.2%CVE-2026-33116HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.1%CVE-2024-28757HIGHlibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityPEPSS 2.0%CVE-2026-26171HIGH.NET Denial of Service VulnerabilityEPSS 1.8%CVE-2023-38490MEDIUMKirby XML External Entity (XXE) vulnerability in the XML data handlerEPSS 1.7%CVE-2019-5442—XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amountsEPSS 1.4%CVE-2021-32623HIGHOpencast vulnerable to billion laughs attack (XML bomb)EPSS 1.3%CVE-2024-43398MEDIUMREXML denial of service vulnerabilityEPSS 1.2%CVE-2024-27141MEDIUMPre-authenticated Time-Based Blind XXE injectionEPSS 1.1%CVE-2023-3569MEDIUMPHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENTEPSS 1.0%CVE-2021-1267MEDIUMCisco Firepower Management Center XML Entity Expansion VulnerabilityEPSS 1.0%CVE-2023-28118HIGHkaml has potential denial of service while parsing input with anchors and aliases EPSS 1.0%CVE-2022-44641MEDIUMIn Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that causEPSS 1.0%CVE-2024-27142MEDIUMPre-authenticated XXE injectionEPSS 0.9%CVE-2026-26278HIGHfast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)EPSS 0.8%CVE-2026-45304HIGHSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")EPSS 0.8%CVE-2024-1455MEDIUMBillion Laughs Attack leading to DoS in langchain-ai/langchainEPSS 0.8%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.7%