← Back
CWE-776

101 CVEs • Abstraction: Base • Likelihood of Exploit: Medium

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

JSON object

Loading...

CVEs (101)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2003-1564
1Xmlsoft
1Libxml2
Apr 16, 2026
Dec 31, 2003
N/A· v4
6.5 MEDIUM· v3
9.3 HIGH· v2
libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document co...Show more
libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."Show less