The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

What CVEs are caused by CWE-776?

41 recorded CVEs are attributed to CWE-776, including CVE-2023-38490, CVE-2019-19144, CVE-2026-44020.

How do you prevent CWE-776?

If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

How is CWE-776 detected?

Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

What are the consequences of CWE-776?

Exploiting CWE-776 can lead to: DoS: Resource Consumption (Other).

Is CWE-776 actively exploited?

41 recorded CVEs are caused by CWE-776; none are currently in CISA's KEV catalog of actively exploited flaws.

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (XEE)

RadicalNotion.AI

Code examples

Illustrative examples from MITRE showing how the weakness appears in code.

The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity contains one character, the letter A. The choice of entity name ZERO is being used to indicate length equivalent to that exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or 2^1. Ultimately, we reach entity THIRTYTWO, which will expand to 2^32 characters in length, or 4 GB, probably consuming far more data than expected.

Attack input

xml

<?xml version="1.0"?>

CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-776

Overview

Real-world CVEs

Common consequences

How it happens

When it is introduced

Applies to

How to prevent it

How to detect it

Automated Static Analysis

Code examples

Illustrative examples

Related weaknesses

Parent

Related

Terminology & mappings

Alternate terms

Mapped taxonomies

Attack patterns

Frequently asked questions

References

Stay ahead of CWE-776