Fallos del tipo CWE-776

62 resultados

Expansão de Entidades XML (XML Entity Expansion)

Ocorre quando um parser XML processa entidades customizadas sem limites, permitindo que um atacante defina entidades recursivas ou que referenciam recursos externos. Isso causa consumo massivo de memória, processamento infinito ou acesso a arquivos sensíveis do servidor.

Ejemplo

Um aplicativo recebe um arquivo XML de um usuário e o processa com um parser vulnerável. O atacante envia um XML com entidades aninhadas (bilhões de risos) ou que referenciam /etc/passwd, causando negação de serviço ou vazamento de dados.

Cómo mitigar

Desabilite resolução de entidades externas e DTD no parser XML (em Java: setFeature com XMLConstants.ACCESS_EXTERNAL_DTD = false). Use parsers seguros por padrão ou valide e sanitize entrada XML com schemas restritivos.

CVE-2024-1455MEDIUMBillion Laughs Attack leading to DoS in langchain-ai/langchainEPSS 0.8%CVE-2026-29074HIGHSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)EPSS 0.7%CVE-2026-45304HIGHSymfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")EPSS 0.7%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2026-45133HIGHSymfony: [Yaml] Harden the parser when handling untrusted inputEPSS 0.6%CVE-2026-108358HIGHPhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of ServiceEPSS 0.6%CVE-2026-33036HIGHfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)EPSS 0.6%CVE-2026-44020HIGHDocling: Unsafe XML Entity Expansion in USPTO Patent BackendEPSS 0.6%CVE-2026-92001MEDIUMApache Sling XSS: Missing parser resource limitsEPSS 0.6%CVE-2026-14979MEDIUMIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attackEPSS 0.5%CVE-2026-78681HIGHNLTK before 3.10.3 Entity Expansion DoS via ElementTreeEPSS 0.5%CVE-2026-12993MEDIUMApicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subsetEPSS 0.5%CVE-2026-33908HIGHImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()EPSS 0.5%CVE-2026-73569HIGHfast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limitsEPSS 0.5%CVE-2026-3415HIGHXML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of ServiceEPSS 0.5%CVE-2025-3225HIGHXML Entity Expansion vulnerability in run-llama/llama_indexEPSS 0.5%CVE-2026-108357HIGHPhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of ServiceEPSS 0.5%CVE-2026-108039HIGHApache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limitsEPSS 0.5%CVE-2026-115506HIGHlibexpat through 2.9.0 Denial of Service via Billion Laughs Detection DelayEPSS 0.4%CVE-2026-54077HIGHArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated usersEPSS 0.4%