Monthly
Denial-of-service exposure in IBM App Connect Enterprise and IBM Integration Bus for z/OS Toolkit allows an authenticated, network-connected user to crash or incapacitate the Toolkit by submitting crafted XML containing recursive or deeply nested entity references. The root cause is CWE-776, improper restriction of recursive entity references in DTDs - commonly called an XML Entity Expansion or 'Billion Laughs' attack. Patch is available per IBM advisory 7286372; no public exploit code or active exploitation has been identified at time of analysis.
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. The result is excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. No active exploitation has been confirmed (not in CISA KEV), but exploitation requires zero authentication or special configuration beyond the default entity-processing behavior.
XML External Entity (XXE) injection and recursive entity expansion in WSO2's SchemaValidator Mediator expose server-side file contents and enable SSRF across a broad range of WSO2 API management products. Exploitation requires a highly privileged actor - confirmed by PR:H in the CVSS vector - who can supply crafted XML payloads to affected mediator flows, triggering unauthorized outbound requests, server file reads, or resource exhaustion that degrades service availability. Vendor patches are available for all listed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
CPU and heap exhaustion in Apicurio Registry's XML artifact processing pipeline allows authenticated users with artifact-write permission to cause denial of service via billion-laughs entity expansion. The DocumentBuilderAccessor correctly blocks external DTD and schema resolution - preventing SSRF/XXE - but omits two complementary protections: disabling DOCTYPE declarations entirely and enabling JAXP's FEATURE_SECURE_PROCESSING flag, leaving the parser exposed to recursive internal entity expansion. No active exploitation (CISA KEV) or confirmed public exploit code has been identified at time of analysis; EPSS data was not provided in the input.
Denial of service in FreeSWITCH versions prior to 1.11.0 allows unauthenticated remote attackers to exhaust CPU and memory by sending a single SIP PUBLISH request whose PIDF body contains a malicious DTD with nested entity declarations. The bundled XML parser expands these entities before any digest authentication check, making this a pre-auth resource exhaustion vector (CWE-776, classic 'billion laughs'). No public exploit identified at time of analysis, but the CVSS 7.5 availability-only impact reflects a high-confidence DoS condition against any exposed FreeSWITCH instance.
XML External Entity (XXE) injection in Docling's USPTO patent backend allows remote attackers to trigger denial of service, read arbitrary server files, or perform SSRF by submitting crafted patent XML to vulnerable versions (>=2.13.0, <2.74.0). The flaw stems from use of Python's unsafe xml.sax.parseString() across the ICE v4.x, Grant v2.5, and Application v1.x parsers. No public exploit identified at time of analysis, but the fix is publicly documented in the vendor advisory and a working patched release is available.
Uncontrolled memory consumption in the Symfony Yaml component lets remote attackers trigger a "Billion Laughs" denial-of-service by supplying crafted YAML in which collection aliases recursively reference other alias-bearing collections, expanding a tiny input into a multi-gigabyte structure that exhausts process memory. Affected versions include symfony/yaml and symfony/symfony < 5.4.52, 6.x < 6.4.40, and 7.x < 7.4.12 (with an 8.0.12 release also published). No public exploit identified at time of analysis and EPSS is low (0.08%), but the flaw is trivially reachable by any application parsing untrusted YAML with the affected component.
Denial-of-service exposure in IBM App Connect Enterprise and IBM Integration Bus for z/OS Toolkit allows an authenticated, network-connected user to crash or incapacitate the Toolkit by submitting crafted XML containing recursive or deeply nested entity references. The root cause is CWE-776, improper restriction of recursive entity references in DTDs - commonly called an XML Entity Expansion or 'Billion Laughs' attack. Patch is available per IBM advisory 7286372; no public exploit code or active exploitation has been identified at time of analysis.
XML Entity Expansion (Billion Laughs) in NLTK before 3.10.3 allows unauthenticated remote attackers to cause denial of service by submitting crafted XML payloads with nested entity declarations that expand exponentially in memory. Multiple NLTK modules rely on Python's xml.etree.ElementTree parser, which honors DTD entity definitions, making them susceptible to this class of attack. No public exploit code has been identified at time of analysis, though the attack technique is universally documented and trivially constructable.
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. The result is excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. No active exploitation has been confirmed (not in CISA KEV), but exploitation requires zero authentication or special configuration beyond the default entity-processing behavior.
XML External Entity (XXE) injection and recursive entity expansion in WSO2's SchemaValidator Mediator expose server-side file contents and enable SSRF across a broad range of WSO2 API management products. Exploitation requires a highly privileged actor - confirmed by PR:H in the CVSS vector - who can supply crafted XML payloads to affected mediator flows, triggering unauthorized outbound requests, server file reads, or resource exhaustion that degrades service availability. Vendor patches are available for all listed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated denial-of-service in Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) is possible because the internal LayoutBuilder control parses client-submitted XML without disabling DTD processing, exposing recursive XML entity expansion (CWE-776, 'Billion Laughs'). Any network-reachable attacker can send a crafted HTTP request containing a self-referencing DTD payload to cause exponential memory and CPU exhaustion on the server-side process. No public exploit code or CISA KEV entry has been identified at time of analysis, but the low attack complexity and absence of authentication make this a straightforward DoS primitive once the target endpoint is located.
Denial of service in IBM Engineering Lifecycle Management's DOORS component exposes unauthenticated remote attackers to crash or degrade the service by submitting XML payloads exploiting recursive entity expansion. Affected deployments span three active release branches - 7.0.3 through Interim Fix 021, 7.1.0 through Interim Fix 009, and 7.2.0 including Interim Fix 001. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS at 0.36% (28th percentile) confirms low current exploitation activity, but the unauthenticated network vector makes remediation advisable for internet-facing or low-trust-network deployments.
CPU and heap exhaustion in Apicurio Registry's XML artifact processing pipeline allows authenticated users with artifact-write permission to cause denial of service via billion-laughs entity expansion. The DocumentBuilderAccessor correctly blocks external DTD and schema resolution - preventing SSRF/XXE - but omits two complementary protections: disabling DOCTYPE declarations entirely and enabling JAXP's FEATURE_SECURE_PROCESSING flag, leaving the parser exposed to recursive internal entity expansion. No active exploitation (CISA KEV) or confirmed public exploit code has been identified at time of analysis; EPSS data was not provided in the input.
Denial of service in FreeSWITCH versions prior to 1.11.0 allows unauthenticated remote attackers to exhaust CPU and memory by sending a single SIP PUBLISH request whose PIDF body contains a malicious DTD with nested entity declarations. The bundled XML parser expands these entities before any digest authentication check, making this a pre-auth resource exhaustion vector (CWE-776, classic 'billion laughs'). No public exploit identified at time of analysis, but the CVSS 7.5 availability-only impact reflects a high-confidence DoS condition against any exposed FreeSWITCH instance.
XML External Entity (XXE) injection in Docling's USPTO patent backend allows remote attackers to trigger denial of service, read arbitrary server files, or perform SSRF by submitting crafted patent XML to vulnerable versions (>=2.13.0, <2.74.0). The flaw stems from use of Python's unsafe xml.sax.parseString() across the ICE v4.x, Grant v2.5, and Application v1.x parsers. No public exploit identified at time of analysis, but the fix is publicly documented in the vendor advisory and a working patched release is available.
Uncontrolled memory consumption in the Symfony Yaml component lets remote attackers trigger a "Billion Laughs" denial-of-service by supplying crafted YAML in which collection aliases recursively reference other alias-bearing collections, expanding a tiny input into a multi-gigabyte structure that exhausts process memory. Affected versions include symfony/yaml and symfony/symfony < 5.4.52, 6.x < 6.4.40, and 7.x < 7.4.12 (with an 8.0.12 release also published). No public exploit identified at time of analysis and EPSS is low (0.08%), but the flaw is trivially reachable by any application parsing untrusted YAML with the affected component.