CWE-776: XEE

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Also known as Improper Restriction of Recursive Entity References in DTDs, Billion Laughs Attack, XML Bomb.

A kind of CWE-674 Uncontrolled Recursion.

From the CWE List. © The MITRE Corporation.