Monthly
CPU exhaustion in libexpat through 2.9.0 lets remote attackers stall XML parsing workloads by supplying a moderately sized document with a large DTD and nested entity definitions, because the billion-laughs amplification check in accountingDiffTolerated() aborts too late and each parse can burn tens of seconds of CPU. Unauthenticated remote attackers (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N) can trigger it wherever an application passes untrusted XML to libexpat with DTD processing and internal general/parameter entity expansion enabled; impact is limited to availability, with no disclosure or modification. No confirmed active exploitation is known, though a public PoC reference exists; it is not verified as working exploit code, and vendor patch material is available upstream (PR #1433).
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. The result is excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. No active exploitation has been confirmed (not in CISA KEV), but exploitation requires zero authentication or special configuration beyond the default entity-processing behavior.
XML External Entity (XXE) injection and recursive entity expansion in WSO2's SchemaValidator Mediator expose server-side file contents and enable SSRF across a broad range of WSO2 API management products. Exploitation requires a highly privileged actor - confirmed by PR:H in the CVSS vector - who can supply crafted XML payloads to affected mediator flows, triggering unauthorized outbound requests, server file reads, or resource exhaustion that degrades service availability. Vendor patches are available for all listed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
Denial of service in FreeSWITCH versions prior to 1.11.0 allows unauthenticated remote attackers to exhaust CPU and memory by sending a single SIP PUBLISH request whose PIDF body contains a malicious DTD with nested entity declarations. The bundled XML parser expands these entities before any digest authentication check, making this a pre-auth resource exhaustion vector (CWE-776, classic 'billion laughs'). No public exploit identified at time of analysis, but the CVSS 7.5 availability-only impact reflects a high-confidence DoS condition against any exposed FreeSWITCH instance.
XML External Entity (XXE) injection in Docling's USPTO patent backend allows remote attackers to trigger denial of service, read arbitrary server files, or perform SSRF by submitting crafted patent XML to vulnerable versions (>=2.13.0, <2.74.0). The flaw stems from use of Python's unsafe xml.sax.parseString() across the ICE v4.x, Grant v2.5, and Application v1.x parsers. No public exploit identified at time of analysis, but the fix is publicly documented in the vendor advisory and a working patched release is available.
Uncontrolled memory consumption in the Symfony Yaml component lets remote attackers trigger a "Billion Laughs" denial-of-service by supplying crafted YAML in which collection aliases recursively reference other alias-bearing collections, expanding a tiny input into a multi-gigabyte structure that exhausts process memory. Affected versions include symfony/yaml and symfony/symfony < 5.4.52, 6.x < 6.4.40, and 7.x < 7.4.12 (with an 8.0.12 release also published). No public exploit identified at time of analysis and EPSS is low (0.08%), but the flaw is trivially reachable by any application parsing untrusted YAML with the affected component.
Denial of service in Docling's METS GBS backend (through version 2.61.0) allows remote attackers to exhaust CPU and memory by submitting a malicious .tar.gz archive containing an XML bomb. The backend parses embedded XML with etree.fromstring() while entity resolution remains enabled, so recursively nested entity definitions expand exponentially during parsing and stall or crash the host processing the document. EPSS is very low (0.02%) and there is no public exploit code or KEV listing, but a vendor-published Notion write-up describes the flaw in detail.
CPU exhaustion in libexpat through 2.9.0 lets remote attackers stall XML parsing workloads by supplying a moderately sized document with a large DTD and nested entity definitions, because the billion-laughs amplification check in accountingDiffTolerated() aborts too late and each parse can burn tens of seconds of CPU. Unauthenticated remote attackers (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N) can trigger it wherever an application passes untrusted XML to libexpat with DTD processing and internal general/parameter entity expansion enabled; impact is limited to availability, with no disclosure or modification. No confirmed active exploitation is known, though a public PoC reference exists; it is not verified as working exploit code, and vendor patch material is available upstream (PR #1433).
Apache CXF versions prior to 4.2.4, 4.1.9, and 3.6.13 allow remote, unauthenticated attackers to cause a denial of service by submitting a very large XML document that exhausts memory and CPU during parsing. The flaw lies in StaxUtils, which by default imposes no limit on the total number of elements or characters, and is most impactful when CXF builds a DOM from the input, such as in SAAJ or WS-Security processing. No public exploit code has been identified, and deployments that enforce a request size limit are largely protected.
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. The result is excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. No active exploitation has been confirmed (not in CISA KEV), but exploitation requires zero authentication or special configuration beyond the default entity-processing behavior.
XML External Entity (XXE) injection and recursive entity expansion in WSO2's SchemaValidator Mediator expose server-side file contents and enable SSRF across a broad range of WSO2 API management products. Exploitation requires a highly privileged actor - confirmed by PR:H in the CVSS vector - who can supply crafted XML payloads to affected mediator flows, triggering unauthorized outbound requests, server file reads, or resource exhaustion that degrades service availability. Vendor patches are available for all listed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
Denial of service in FreeSWITCH versions prior to 1.11.0 allows unauthenticated remote attackers to exhaust CPU and memory by sending a single SIP PUBLISH request whose PIDF body contains a malicious DTD with nested entity declarations. The bundled XML parser expands these entities before any digest authentication check, making this a pre-auth resource exhaustion vector (CWE-776, classic 'billion laughs'). No public exploit identified at time of analysis, but the CVSS 7.5 availability-only impact reflects a high-confidence DoS condition against any exposed FreeSWITCH instance.
XML External Entity (XXE) injection in Docling's USPTO patent backend allows remote attackers to trigger denial of service, read arbitrary server files, or perform SSRF by submitting crafted patent XML to vulnerable versions (>=2.13.0, <2.74.0). The flaw stems from use of Python's unsafe xml.sax.parseString() across the ICE v4.x, Grant v2.5, and Application v1.x parsers. No public exploit identified at time of analysis, but the fix is publicly documented in the vendor advisory and a working patched release is available.
Uncontrolled memory consumption in the Symfony Yaml component lets remote attackers trigger a "Billion Laughs" denial-of-service by supplying crafted YAML in which collection aliases recursively reference other alias-bearing collections, expanding a tiny input into a multi-gigabyte structure that exhausts process memory. Affected versions include symfony/yaml and symfony/symfony < 5.4.52, 6.x < 6.4.40, and 7.x < 7.4.12 (with an 8.0.12 release also published). No public exploit identified at time of analysis and EPSS is low (0.08%), but the flaw is trivially reachable by any application parsing untrusted YAML with the affected component.
Denial of service in Docling's METS GBS backend (through version 2.61.0) allows remote attackers to exhaust CPU and memory by submitting a malicious .tar.gz archive containing an XML bomb. The backend parses embedded XML with etree.fromstring() while entity resolution remains enabled, so recursively nested entity definitions expand exponentially during parsing and stall or crash the host processing the document. EPSS is very low (0.02%) and there is no public exploit code or KEV listing, but a vendor-published Notion write-up describes the flaw in detail.