CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.

Consequences

• Availability: DoS: Resource Consumption (Other)

How to prevent it

• Operation: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
• Implementation: Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

Recent advisories

• GHSA-3x94-m842-937c — PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
• GHSA-rxj4-h86g-25gc — PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
• GHSA-97qj-x29f-37w7 — NLTK: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses
• GHSA-8r6m-32jq-jx6q — fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
• GHSA-4qpc-3hr4-r2p4 — Symfony's YAML Parser Vulnerable to Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")
• GHSA-c2p3-7m5p-cv8x — Symfony hardened the parser when handling untrusted input
• GHSA-2v35-w6hq-6mfw — xmldom: Uncontrolled recursion in XML serialization leads to DoS
• GHSA-37gx-xxp4-5rgx — Microsoft Security Advisory CVE-2026-33116 – .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability
• GHSA-w3x6-4m5h-cxqf — Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability
• GHSA-fwvm-ggf6-2p4x — ImageMagick has a Stack Overflow in DestroyXMLTree()
• GHSA-3crg-w4f6-42mx — pypdf: Manipulated XMP metadata entity declarations can exhaust RAM
• GHSA-8gc5-j5rx-235r — fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)
• GHSA-xpqw-6gx7-v673 — SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)
• GHSA-jmr7-xgp7-cmfj — fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit)
• GHSA-c2f4-jgmc-q2r5 — REXML has DoS condition when parsing malformed XML file

All advisories for CWE-776