Falhas do tipo CWE-776

62 resultados

Expansão de Entidades XML (Ataque Bilhete de Loteria XML)

Ocorre quando um parser XML processa entidades definidas pelo usuário sem limitar a profundidade ou tamanho de expansão. Um atacante injeta entidades aninhadas ou recursivas que, ao serem expandidas, consumem memória ou CPU de forma excessiva, causando negação de serviço. O perigo está em que um arquivo XML pequeno pode explodir em gigabytes na memória durante o parse.

Exemplo

Um serviço que aceita upload de notas fiscais em XML. O atacante envia um arquivo com entidades aninhadas tipo <!ENTITY lol "&lol;&lol;&lol;...">, que quando expandidas multiplicam exponencialmente. O servidor trava ao tentar desserializar, indisponibilizando a aplicação.

Como mitigar

Desabilite a resolução de entidades externas e a expansão de entidades em geral no parser XML (usar XMLConstants.ACCESS_EXTERNAL_DTD = "" em Java, ou LIBXML_NOENT = false em PHP). Implemente limites de tamanho e profundidade no parse; considere usar parsers mais restritivos ou validar o XML com schema antes do processamento.

CVE-2026-14865MEDIUMXXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAXEPSS 0.4%CVE-2026-40260MEDIUMpypdf: Manipulated XMP metadata entity declarations can exhaust RAMEPSS 0.4%CVE-2026-108086HIGHApache Cocoon: XEE could lead to SSRF and information disclosureEPSS 0.4%CVE-2025-0617MEDIUMAn attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection EPSS 0.4%CVE-2026-74030MEDIUMWazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias ExpansionEPSS 0.4%CVE-2026-42212HIGHSolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parserEPSS 0.4%CVE-2023-52426MEDIUMlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.EPSS 0.4%CVE-2024-28982HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2023-46035MEDIUMThe svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents.EPSS 0.4%CVE-2026-45771HIGHFreeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity ExpansionEPSS 0.3%CVE-2026-58234LOWDenial of Service vulnerability in SAP Process Integration (SOAP Adapter)EPSS 0.3%CVE-2026-16180MEDIUMIBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsEPSS 0.3%CVE-2026-27807MEDIUMMarkUs: YAML alias (‘billion laughs’) DoS in config uploadEPSS 0.3%CVE-2025-20369MEDIUMExtensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk EnterpriseEPSS 0.3%CVE-2026-31248HIGHDocling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML files froEPSS 0.3%CVE-2026-23822MEDIUMUnauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of ServiceEPSS 0.3%CVE-2026-111252MEDIUMOpenNMS denial of service via XML entity expansionEPSS 0.2%CVE-2021-31842MEDIUMXML Entity Expansion injection vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2021 Update allows a loEPSS 0.2%CVE-2026-119724HIGHApache JClouds: XML External Entity (XXE) in provider-response parsingEPSS 0.2%CVE-2022-28652MEDIUM~/.config/apport/settings parsing is vulnerable to "billion laughs" attackEPSS 0.2%