CWE-776: XEE
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Also known as Improper Restriction of Recursive Entity References in DTDs, Billion Laughs Attack, XML Bomb.
A kind of CWE-674 Uncontrolled Recursion.
From the CWE List. © The MITRE Corporation.
Newest
- tootallnate plist.js plist.js before 5.0.1 Uncontrolled Resource Consumption via Binary Parser 8.7 High
- apache jclouds Apache JClouds: XML External Entity (XXE) in provider-response parsing 7.5 High
- libexpat libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay 8.7 High
- phpoffice phpspreadsheet PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service 8.8 High
- phpoffice phpspreadsheet PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service 8.8 High
- apache software foundation cocoon Apache Cocoon: XEE could lead to SSRF and information disclosure 7.5 High
- openstack horizon, the opennms group meridian +1 more OpenNMS denial of service via XML entity expansion 6.5 Medium
- wazuh wazuh-agent, wazuh-manager +1 more Wazuh 3.9.0 before 4.14.8 Memory Exhaustion via SCA YAML Alias Expansion 6.9 Medium
- apache cxf Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits 7.5 High
- apache software foundation sling xss, apache sling xss protection api +1 more Apache Sling XSS: Missing parser resource limits 6.1 Medium
- sap se process integration (soap adapter) Denial of Service vulnerability in SAP Process Integration (SOAP Adapter) 2.2 Low
- ibm app connect enterprise, integration bus for z/os, integration bus for z\/os +2 more IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs 5.7 Medium
- nltk NLTK before 3.10.3 Entity Expansion DoS via ElementTree 8.7 High
- wso2 api control plane, api manager, carbon api gateway +3 more +5 more XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service 8.7 High
- progress telerik ui for asp.net ajax XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX 5.3 Medium
- naturalintelligence fast-xml-parser fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits 8.7 High
- ibm engineering lifecycle management IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack 5.3 Medium
- arcadedata arcadedb, com.arcadedb arcadedb-engine +1 more ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users 7.1 High
- red hat build of apicurio registry 3.3.1, redhat build of apicurio registry +1 more Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset 6.5 Medium
-
ultimate-sitemap-parserPyPI Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser 7.5 High - freeswitch Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion 7.5 High
- nlnet labs routinator Routinator crashes on specifically crafted RRDP XML files 8.7 High
- docling, red hat openshift ai 3.4 +1 more Docling: Unsafe XML Entity Expansion in USPTO Patent Backend 7.5 High
- docling Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend 5.5 Medium
- eemeli yaml, sensiolabs symfony +1 more Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") 8.7 High
- sensiolabs symfony Symfony: [Yaml] Harden the parser when handling untrusted input 8.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) arubaos (aos) +1 more Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service 5.3 Medium
-
doclingPyPI Docling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks 7.5 High - anzory solidcam-gppl-ide SolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parser 7.1 High
- xmldom, red hat build of podman desktop, developer hub 1.9 +6 more +8 more xmldom: Denial of service via uncontrolled recursion in XML serialization 8.7 High
- microsoft .net, .net framework, .net 10.0 +15 more +17 more .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability 7.5 High
- microsoft .net, powershell 7.6, microsoft .net 10.0 +11 more +13 more .NET Denial of Service Vulnerability 7.5 High
- imagemagick, red hat enterprise linux 6, enterprise linux 7 +2 more ImageMagick is vulnerable to Stack Overflow in DestroyXMLTree() 7.5 High
- py-pdf pypdf pypdf: Manipulated XMP metadata entity declarations can exhaust RAM 6.9 Medium
- naturalintelligence fast-xml-parser fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) 7.5 High
- markusproject markus MarkUs: YAML alias (‘billion laughs’) DoS in config upload 4.9 Medium
- svg svgo, red hat cryostat 4, gatekeeper 3 +45 more +47 more SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs) 7.5 High
- naturalintelligence fast-xml-parser, red hat migration toolkit for applications 8, advanced cluster security 4.8 +11 more +13 more fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) 7.5 High
- splunk, splunk cloud platform, enterprise +2 more Extensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk Enterprise 4.6 Medium
- ruby rexml REXML has a DoS condition when parsing malformed XML file 1.2 Low
- ivanti connect secure, neurons for secure access, policy secure +2 more +4 more XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5,... 4.9 Medium
- No product listed XML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304)... 9.8 Critical
- llamaindex, run-llama run-llama/llama index +1 more XML Entity Expansion vulnerability in run-llama/llama_index 7.5 High
- trellix hx console An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data... 5.9 Medium
- ruby rexml, netapp bootstrap os +1 more REXML denial of service vulnerability 5.9 Medium
- hitachi pentaho business analytics server Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference 7.1 High
- toshiba tec corporation tec e-studio multi-function peripheral (mfp) Pre-authenticated XXE injection 5.9 Medium
- toshiba tec corporation tec e-studio multi-function peripheral (mfp), toshibatec e-studio-2010-ac, e-studio-2015-nc +40 more +42 more Pre-authenticated Time-Based Blind XXE injection 5.9 Medium
-
zendframework/zend-jsonPackagist Zend-JSON vulnerable to XXE/XEE attacks 9.8 Critical -
zendframework/zendframework1Packagist Zendframework Denial of Service vector via XEE injection 7.5 High - Show olderLoading…