Weaknesses of type CWE-776

52 results

Expansão de Entidades XML (XML Entity Expansion)

Fraqueza que ocorre quando um parser XML processa entidades externas ou recursivas sem validação, permitindo que um atacante defina entidades que se expandem exponencialmente e consumam recursos da aplicação. O risco é negação de serviço (DoS) ou, em casos piores, acesso a arquivos sensíveis do servidor.

Example

Um atacante envia um XML com entidades aninhadas que se expandem recursivamente (ataque Billion Laughs): quando o servidor processa, a entidade `&lol;` contém 10 cópias de `&lol2;`, que contém 10 cópias de `&lol3;`, etc. Isso explode para bilhões de caracteres, travando o parser e o serviço.

How to mitigate

Configure o parser XML para desabilitar DTDs (Document Type Definitions) e entidades externas; use bibliotecas com validação estrita; implemente limites de tamanho e tempo de processamento para documentos XML; valide e sanitize entrada XML antes do parsing.

CVE-2026-45304HIGHSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")EPSS 0.7%CVE-2025-5466MEDIUMXEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and IvaEPSS 0.7%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2026-29074HIGHSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)EPSS 0.6%CVE-2026-44020HIGHDocling: Unsafe XML Entity Expansion in USPTO Patent BackendEPSS 0.6%CVE-2026-33036HIGHfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)EPSS 0.6%CVE-2026-12993MEDIUMApicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subsetEPSS 0.5%CVE-2026-33908HIGHImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()EPSS 0.5%CVE-2026-14865MEDIUMXXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAXEPSS 0.4%CVE-2026-40260MEDIUMpypdf: Manipulated XMP metadata entity declarations can exhaust RAMEPSS 0.4%CVE-2025-3225HIGHXML Entity Expansion vulnerability in run-llama/llama_indexEPSS 0.4%CVE-2025-0617MEDIUMAn attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection EPSS 0.4%CVE-2026-14979MEDIUMIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attackEPSS 0.4%CVE-2024-28982HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2026-54077HIGHArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated usersEPSS 0.4%CVE-2023-52426MEDIUMlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.EPSS 0.4%CVE-2026-73569HIGHfast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limitsEPSS 0.4%CVE-2023-46035MEDIUMThe svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.EPSS 0.4%CVE-2026-45771HIGHFreeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity ExpansionEPSS 0.3%