CWE Database
/

CWE-776

Back to CWE list

CWE-776

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Base
Draft

Description

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.

Common Consequences

Scope

Availability

Impact

DoS: Resource Consumption (Other)

Potential Mitigations

Operation

If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

Implementation

Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

CVE-2008-3281

XEE in XML-parsing library.

CVE-2011-3288

XML bomb / XEE in enterprise communication product.

CVE-2011-1755

"Billion laughs" attack in XMPP server daemon.

CVE-2009-1955

XML bomb in web server module

CVE-2003-1564

Parsing library allows XML bomb

Applicable Platforms

Not Language-Specific
XML

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now