Fallos del tipo CWE-776
45 resultadosExpansão de Entidades XML (XML Entity Expansion)
Ocorre quando um parser XML processa entidades customizadas sem limites, permitindo que um atacante defina entidades recursivas ou que referenciam recursos externos. Isso causa consumo massivo de memória, processamento infinito ou acesso a arquivos sensíveis do servidor.
Ejemplo
Um aplicativo recebe um arquivo XML de um usuário e o processa com um parser vulnerável. O atacante envia um XML com entidades aninhadas (bilhões de risos) ou que referenciam /etc/passwd, causando negação de serviço ou vazamento de dados.
Cómo mitigar
Desabilite resolução de entidades externas e DTD no parser XML (em Java: setFeature com XMLConstants.ACCESS_EXTERNAL_DTD = false). Use parsers seguros por padrão ou valide e sanitize entrada XML com schemas restritivos.
CVE-2019-5427—c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursiEPSS 4.9%CVE-2022-0217—It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsEPSS 4.7%CVE-2020-5227MEDIUMFeedgen Vulnerable to XML Denial of Service AttacksEPSS 2.2%CVE-2026-33116HIGH.NET, .NET Framework, and Visual Studio Denial of Service VulnerabilityEPSS 2.1%CVE-2024-28757HIGHlibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityPEPSS 2.0%CVE-2026-26171HIGH.NET Denial of Service VulnerabilityEPSS 1.8%CVE-2023-38490MEDIUMKirby XML External Entity (XXE) vulnerability in the XML data handlerEPSS 1.7%CVE-2019-5442—XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amountsEPSS 1.4%CVE-2021-32623HIGHOpencast vulnerable to billion laughs attack (XML bomb)EPSS 1.3%CVE-2024-43398MEDIUMREXML denial of service vulnerabilityEPSS 1.2%CVE-2024-27141MEDIUMPre-authenticated Time-Based Blind XXE injectionEPSS 1.1%CVE-2023-3569MEDIUMPHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENTEPSS 1.0%CVE-2021-1267MEDIUMCisco Firepower Management Center XML Entity Expansion VulnerabilityEPSS 1.0%CVE-2023-28118HIGHkaml has potential denial of service while parsing input with anchors and aliases EPSS 1.0%CVE-2022-44641MEDIUMIn Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that causEPSS 1.0%CVE-2024-27142MEDIUMPre-authenticated XXE injectionEPSS 0.9%CVE-2026-26278HIGHfast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)EPSS 0.8%CVE-2026-45304HIGHSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")EPSS 0.8%CVE-2024-1455MEDIUMBillion Laughs Attack leading to DoS in langchain-ai/langchainEPSS 0.8%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.7%