CWE-776: XEE
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Also known as Improper Restriction of Recursive Entity References in DTDs, Billion Laughs Attack, XML Bomb.
A kind of CWE-674 Uncontrolled Recursion.
From the CWE List. © The MITRE Corporation.
Newest
- jabberd2, apple mac os x, mac os x server +1 more +3 morejabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows...7.5 High
- apache apr-util, http server, apple mac os x +4 more +6 moreThe expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7,...7.5 High
- xmlsoft libxml2, apple iphone os, safari +8 more +10 morelibxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an...6.5 Medium
- xmlsoft libxml2libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which...6.5 Medium