Weaknesses of type CWE-776

62 results

Expansão de Entidades XML (XML Entity Expansion)

Fraqueza que ocorre quando um parser XML processa entidades externas ou recursivas sem validação, permitindo que um atacante defina entidades que se expandem exponencialmente e consumam recursos da aplicação. O risco é negação de serviço (DoS) ou, em casos piores, acesso a arquivos sensíveis do servidor.

Example

Um atacante envia um XML com entidades aninhadas que se expandem recursivamente (ataque Billion Laughs): quando o servidor processa, a entidade `&lol;` contém 10 cópias de `&lol2;`, que contém 10 cópias de `&lol3;`, etc. Isso explode para bilhões de caracteres, travando o parser e o serviço.

How to mitigate

Configure o parser XML para desabilitar DTDs (Document Type Definitions) e entidades externas; use bibliotecas com validação estrita; implemente limites de tamanho e tempo de processamento para documentos XML; valide e sanitize entrada XML antes do parsing.

CVE-2024-1455MEDIUMBillion Laughs Attack leading to DoS in langchain-ai/langchainEPSS 0.8%CVE-2026-29074HIGHSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)EPSS 0.7%CVE-2026-45304HIGHSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")EPSS 0.7%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2026-108358HIGHPhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceEPSS 0.6%CVE-2026-33036HIGHfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)EPSS 0.6%CVE-2026-44020HIGHDocling: Unsafe XML Entity Expansion in USPTO Patent BackendEPSS 0.6%CVE-2026-92001MEDIUMApache Sling XSS: Missing parser resource limitsEPSS 0.6%CVE-2026-14979MEDIUMIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attackEPSS 0.5%CVE-2026-78681HIGHNLTK before 3.10.3 Entity Expansion DoS via ElementTreeEPSS 0.5%CVE-2026-12993MEDIUMApicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subsetEPSS 0.5%CVE-2026-33908HIGHImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()EPSS 0.5%CVE-2026-73569HIGHfast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limitsEPSS 0.5%CVE-2026-3415HIGHXML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of ServiceEPSS 0.5%CVE-2025-3225HIGHXML Entity Expansion vulnerability in run-llama/llama_indexEPSS 0.5%CVE-2026-108357HIGHPhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServiceEPSS 0.5%CVE-2026-108039HIGHApache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limitsEPSS 0.5%CVE-2026-115506HIGHlibexpat through 2.9.0 Denial of Service via Billion Laughs Detection DelayEPSS 0.4%CVE-2026-54077HIGHArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated usersEPSS 0.4%