Base weakness
Draft
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
Also known as: XEE, Billion Laughs Attack, XML Bomb
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
32
Recorded CVEs
With this primary weakness
0
KEVs
In the CISA KEV catalog
Medium
Likelihood of exploit
Per MITRE
Base
Abstraction
MITRE classification
Overview
If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.