OpenNMS Meridian CVE-2026-111252

Exploitation requires an authenticated account with provisioning access (per PR:L in the CVSS vector and the description's explicit 'authenticated user with provisioning access'). The attacker supplies a requisition or foreign-source XML document - either directly or via a remote requisition URL the server fetches - that contains a DOCTYPE declaring internal entities built for expansion (nested entities or a single large entity referenced repeatedly). Limiting factors: the trusted provisioning privilege level narrows the attacker population to insiders or holders of a compromised provisioning account; the vendor explicitly states OpenNMS is intended to run within private networks and not be directly internet-accessible, so default deployments are not exposed to anonymous remote attackers; and the impact is limited to denial of service with no data disclosure or modification.

This is a moderate-priority availability issue, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: exploitation is remote and low-complexity but requires an authenticated account holding provisioning privileges (PR:L), and impact is confined to availability (memory exhaustion / denial of service) with no confidentiality or integrity loss. No EPSS score, CISA KEV listing, or public POC was supplied, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no signal of active or widespread exploitation. The PR:L requirement is the key risk-reducer: an attacker must already have provisioning/requisition access, which is a trusted administrative role, so the realistic threat is a malicious or compromised insider rather than an anonymous internet attacker. The vendor also notes the product is designed to run inside private networks and not be internet-facing, further narrowing exposure. Net: a genuine but bounded DoS, appropriately rated medium; prioritize patching where many operators hold provisioning rights or where the management plane is not tightly isolated.

An authenticated user with provisioning access submits a requisition or foreign-source XML document (or points the server at a remote requisition URL it will fetch) containing a DOCTYPE that declares internal entities crafted as a 'billion laughs'-style expansion - deeply nested entities or one large entity referenced many times. When OpenNMS parses the document, entity expansion balloons memory usage and exhausts the server's heap, causing a denial of service. No public exploit code was identified, but the technique is well-known and the fix (PR #8898/#8952) confirms the parser previously had no entity-expansion cap.