CWE-776 - Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Description

The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service. If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources. The weakness is introduced during Implementation, Operation stages.

Latest vulnerabilities for CWE-776

Multiple vulnerabilities in IBM Cognos Analytics Mobile (iOS) 2024-11-08
High Yes Public exploit

Multiple vulnerabilities in IBM Cognos Analytics Mobile (Android) 2024-11-06
High Yes

Multiple vulnerabilities in Oracle Linux 2024-10-16
Critical Yes Public exploit

Multiple vulnerabilities in IBM License Metric Tool 2024-09-18
Medium Yes

Multiple vulnerabilities in HPE NonStop Vrtual Tape Repository (VTR) 2024-09-16
High Yes

Multiple vulnerabilities in IBM Application Performance Management 2024-08-28
High Yes

Multiple vulnerabilities in REXML gem 2024-08-01
Medium Yes

Multiple vulnerabilities in Dell Data Lakehouse System Software 2024-07-30
Critical Yes

Multiple vulnerabilities in IBM Cognos Dashboards on Cloud Pak for Data 2024-06-28
High Yes

Multiple vulnerabilities in Oki Electric Industry MFPs 2024-06-21
High Yes

References

Description of CWE-776 on Mitre website