Weaknesses of type CWE-776

62 results

Expansão de Entidades XML (XML Entity Expansion)

Fraqueza que ocorre quando um parser XML processa entidades externas ou recursivas sem validação, permitindo que um atacante defina entidades que se expandem exponencialmente e consumam recursos da aplicação. O risco é negação de serviço (DoS) ou, em casos piores, acesso a arquivos sensíveis do servidor.

Example

Um atacante envia um XML com entidades aninhadas que se expandem recursivamente (ataque Billion Laughs): quando o servidor processa, a entidade `&lol;` contém 10 cópias de `&lol2;`, que contém 10 cópias de `&lol3;`, etc. Isso explode para bilhões de caracteres, travando o parser e o serviço.

How to mitigate

Configure o parser XML para desabilitar DTDs (Document Type Definitions) e entidades externas; use bibliotecas com validação estrita; implemente limites de tamanho e tempo de processamento para documentos XML; valide e sanitize entrada XML antes do parsing.

CVE-2026-14865MEDIUMXXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAXEPSS 0.4%CVE-2026-40260MEDIUMpypdf: Manipulated XMP metadata entity declarations can exhaust RAMEPSS 0.4%CVE-2026-108086HIGHApache Cocoon: XEE could lead to SSRF and information disclosureEPSS 0.4%CVE-2025-0617MEDIUMAn attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection EPSS 0.4%CVE-2026-74030MEDIUMWazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias ExpansionEPSS 0.4%CVE-2026-42212HIGHSolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parserEPSS 0.4%CVE-2023-52426MEDIUMlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.EPSS 0.4%CVE-2024-28982HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2023-46035MEDIUMThe svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.EPSS 0.4%CVE-2026-45771HIGHFreeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity ExpansionEPSS 0.3%CVE-2026-58234LOWDenial of Service vulnerability in SAP Process Integration (SOAP Adapter)EPSS 0.3%CVE-2026-16180MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2026-27807MEDIUMMarkUs: YAML alias (‘billion laughs’) DoS in config uploadEPSS 0.3%CVE-2025-20369MEDIUMExtensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk EnterpriseEPSS 0.3%CVE-2026-31248HIGHDocling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML files froEPSS 0.3%CVE-2026-23822MEDIUMUnauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of ServiceEPSS 0.3%CVE-2026-111252MEDIUMOpenNMS denial of service via XML entity expansionEPSS 0.2%CVE-2021-31842MEDIUMXML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a loEPSS 0.2%CVE-2026-119724HIGHApache JClouds: XML External Entity (XXE) in provider-response parsingEPSS 0.2%CVE-2022-28652MEDIUM~/.config/apport/settings parsing is vulnerable to "billion laughs" attackEPSS 0.2%