Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

CVEs (91)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-12401 1Apache 1Solr Jun 17, 2026 Sep 10, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the att...Show more Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it’s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.Show less
CVE-2019-15903 2Libexpat Project Python 2Libexpat Python Jun 17, 2026 Sep 4, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted...Show more In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.Show less
CVE-2019-15160 1Kbrw 1Sweet Xml Jun 17, 2026 Aug 19, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
CVE-2019-5442 1Pippo 1Pippo Jun 17, 2026 Jun 12, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Ot...Show more XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.Show less
CVE-2019-5427 3Fedoraproject MchangeOracle 11C3p0 Communications Ip Service ActivatorCommunications Session Route Manager+8 more Jun 17, 2026 Apr 22, 2019 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
CVE-2017-5644 1Apache 1Poi May 13, 2026 Mar 24, 2017 N/A· v4 5.5 MEDIUM· v3 7.1 HIGH· v2 Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVE-2011-3288 1Cisco 1Unified Presence Apr 29, 2026 Oct 6, 2011 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XM...Show more Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug IDs CSCtq89842 and CSCtq88547, a similar issue to CVE-2003-1564.Show less
CVE-2011-1755 3Apple FedoraprojectJabberd2 4Fedora Jabberd2Mac Os X+1 more Apr 29, 2026 Jun 21, 2011 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large num...Show more jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.Show less
CVE-2009-1955 7Apache AppleCanonical+4 more 8Apr Util Debian LinuxFedora+5 more Apr 23, 2026 Jun 8, 2009 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of ser...Show more The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.Show less
CVE-2008-3281 7Apple CanonicalDebian+4 more 11Debian Linux Enterprise Linux DesktopEnterprise Linux Eus+8 more Apr 23, 2026 Aug 27, 2008 N/A· v4 6.5 MEDIUM· v3 4.3 MEDIUM· v2 libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafte...Show more libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.Show less
CVE-2003-1564 1Xmlsoft 1Libxml2 Apr 16, 2026 Dec 31, 2003 N/A· v4 6.5 MEDIUM· v3 9.3 HIGH· v2 libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document co...Show more libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."Show less

Previous 1 2 3 45