Improper Restriction of Recursive Entity References in DTDs
CWE-776
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
We track 35 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 7.8.
How this weakness is prevented
- Operation: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
- Implementation: Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
Latest Improper Restriction of Recursive Entity References in DTDs vulnerabilities
- 7.5 High severity
plist.js: Uncontrolled Recursion
plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolut
- 7.5 High severity
Apache JClouds: Improper Restriction of Recursive Entity References in DTDs
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache JClouds. This issue affects Apache JClouds: all versions. As this project is retired, we do not plan to release a versi
- 7.5 High severity
libexpat: Improper Restriction of Recursive Entity References in DTDs
libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nest
- 8.8 High severity
PhpSpreadsheet: Improper Restriction of XML External Entity Reference
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScanner::scan in src/PhpSpreadsheet/Reader/Security/XmlScanner.php uses a DOCTYPE detection pattern that accounts for NUL-byt
- 8.8 High severity
PhpSpreadsheet: Improper Restriction of XML External Entity Reference
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored SpreadsheetML XML through XmlScanner::scan in Xml::canRead and Xml::trySimpleXMLLoadStringPrivate, while Xml::unentity
- 7.5 High severity
Apache Cocoon: Improper Restriction of Recursive Entity References in DTDs
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exp
- 7.5 High severity
Apache CXF: Improper Restriction of Recursive Entity References in DTDs
By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large request could therefore use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (for e
- 7.1 High severity
arcadedb: Improper Limitation of a Pathname to a Restricted Directory
ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.java did not require administrative privileges and passed its source to integration/src/main/java/com/a
- 7.5 High severity
nltk: Improper Restriction of Recursive Entity References in DTDs
NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memor
- 8.7 High severity
fast-xml-parser: Improper Restriction of Recursive Entity References in DTDs
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's
- 8.7 High severity
WSO2 API Manager: Improper Restriction of Recursive Entity References in DTDs
The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certain conditions, the XML parser allows the resolution of external entities when handling user-supplied XML content during
- 7.5 High severity
Engineering Lifecycle Management: Improper Restriction of Recursive Entity References in DTDs
IBM Engineering Lifecycle Management 7.0.3 ( Interim Fix 001 through ) Interim Fix 021, 7.1.0 ( Interim Fix 001 through ) Interim Fix 009, and 7.2.0 and 7.2.0 Interim Fix 001 DOORS could allow a remote attacker to cause a denial of service due to improper hand
- 7.5 High severity
symfony: Improper Restriction of Recursive Entity References in DTDs
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to
- 7.5 High severity
symfony: Uncontrolled Recursion
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-lev
- 7.1 High severity
docling: Improper Handling of Highly Compressed Data (Data Amplification)
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.45.0 until 2.91.0, the METS-GBS backend's XML parsing and the input document format detection lacked security controls. An att
- 7.5 High severity
docling: Improper Restriction of Recursive Entity References in DTDs
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.13.0 until 2.74.0, the USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External
- 7.5 High severity
freeswitch: Improper Restriction of Recursive Entity References in DTDs
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH's bundled XML parser expands nested <!ENT
- 7.1 High severity
SolidCAM-GPPL-IDE: Uncontrolled Resource Consumption
SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCAM. From version 1.0.0 to before version 1.0.2, Opening a .gpp file in the SolidCAM Postprocessor IDE extension causes the language server to parse a companion .
- 7.5 High severity
xmldom: Uncontrolled Recursion
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a d
- 7.5 High severity
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio…
Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.
- 7.5 High severity
ImageMagick: Uncontrolled Recursion
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions below both 7.1.2-19 and 6.9.13-44, Magick frees the memory of the XML tree via the `DestroyXMLTree()` function; however, this process is executed recursi
- 7.5 High severity
fast-xml-parser: Improper Restriction of Recursive Entity References in DTDs
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 contain a bypass vulnerability where numeric character references (&#NNN;, &#xHH;) and standard XML entities completely e
- 7.5 High severity
svgo: Improper Restriction of Recursive Entity References in DTDs
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities,
- 7.5 High severity
fast-xml-parser: Improper Restriction of Recursive Entity References in DTDs
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 4.1.3 through 5.3.5, the XML parser can be forced to do an unlimited amount of entity expansion. With a
- 7.5 High severity
run-llama/llama_index: Improper Restriction of Recursive Entity References in DTDs
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap X
- 8.2 High severity
Pentaho Business Analytics Server: Improper Restriction of Recursive Entity References in DTDs
Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.
- 7.5 High severity
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP…: Improper Restriction of Recursive Entity References in DTDs
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
- 10.0 Critical severity
kirby: Improper Restriction of XML External Entity Reference
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plug
- 7.5 High severity
kaml: Improper Restriction of Recursive Entity References in DTDs
kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAML
- 7.5 High severity
Dell Hybrid Client (DHC): Improper Restriction of Recursive Entity References in DTDs
Dell Hybrid Client below 1.8 version contains a Zip Bomb Vulnerability in UI. A guest privilege attacker could potentially exploit this vulnerability, leading to system files modification.
- 7.5 High severity
org.yaml:snakeyaml: Improper Restriction of Recursive Entity References in DTDs
The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.
- 7.5 High severity
prosody: Improper Restriction of XML External Entity Reference
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776)
- 7.5 High severity
untangle: Improper Restriction of Recursive Entity References in DTDs
untangle is a python library to convert XML data to python objects. untangle versions 1.2.0 and earlier improperly restricts recursive entity references in DTDs. By exploiting this vulnerability, a remote unauthenticated attacker may cause a denial-of-service
- 7.5 High severity
Proteus: Improper Restriction of Recursive Entity References in DTDs
An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x throug
- 9.8 Critical severity
excel-streaming-reader: Improper Restriction of Recursive Entity References in DTDs
Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1