Falhas do tipo CWE-776

45 resultados

Expansão de Entidades XML (Ataque Bilhete de Loteria XML)

Ocorre quando um parser XML processa entidades definidas pelo usuário sem limitar a profundidade ou tamanho de expansão. Um atacante injeta entidades aninhadas ou recursivas que, ao serem expandidas, consumem memória ou CPU de forma excessiva, causando negação de serviço. O perigo está em que um arquivo XML pequeno pode explodir em gigabytes na memória durante o parse.

Exemplo

Um serviço que aceita upload de notas fiscais em XML. O atacante envia um arquivo com entidades aninhadas tipo <!ENTITY lol "&lol;&lol;&lol;...">, que quando expandidas multiplicam exponencialmente. O servidor trava ao tentar desserializar, indisponibilizando a aplicação.

Como mitigar

Desabilite a resolução de entidades externas e a expansão de entidades em geral no parser XML (usar XMLConstants.ACCESS_EXTERNAL_DTD = "" em Java, ou LIBXML_NOENT = false em PHP). Implemente limites de tamanho e profundidade no parse; considere usar parsers mais restritivos ou validar o XML com schema antes do processamento.

CVE-2022-34467—A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer ModEPSS 0.7%CVE-2019-19144CRITICALXML External Entity Injection vulnerability in Quantum DXi6702 2.3.0.3 (11449-53631 Build304) devices via rest/Users?action=authenticate.EPSS 0.7%CVE-2026-41673HIGHxmldom: Denial of service via uncontrolled recursion in XML serializationEPSS 0.6%CVE-2025-5466MEDIUMXEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and IvaEPSS 0.6%CVE-2026-29074HIGHSVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)EPSS 0.6%CVE-2026-33036HIGHfast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278)EPSS 0.6%CVE-2026-33908HIGHImageMagick is vulnerable to Stack Overflow in DestroyXMLTree()EPSS 0.5%CVE-2026-40260MEDIUMpypdf: Manipulated XMP metadata entity declarations can exhaust RAMEPSS 0.4%CVE-2025-3225HIGHXML Entity Expansion vulnerability in run-llama/llama_indexEPSS 0.4%CVE-2025-0617MEDIUMAn attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection EPSS 0.4%CVE-2024-28982HIGHHitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity ReferenceEPSS 0.4%CVE-2023-52426MEDIUMlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.EPSS 0.4%CVE-2026-14979MEDIUMIBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attackEPSS 0.4%CVE-2026-45771HIGHFreeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity ExpansionEPSS 0.3%CVE-2026-44020HIGHDocling: Unsafe XML Entity Expansion in USPTO Patent BackendEPSS 0.3%CVE-2026-42212HIGHSolidCAM-GPPL-IDE: XML External Entity (XXE) and billion-laughs DoS in VMID parserEPSS 0.3%CVE-2025-20369MEDIUMExtensible Markup Language (XML) External Entity Injection (XXE) through Dashboard label field on Splunk EnterpriseEPSS 0.3%CVE-2026-27807MEDIUMMarkUs: YAML alias (‘billion laughs’) DoS in config uploadEPSS 0.3%CVE-2026-31248HIGHDocling's METS GBS backend is vulnerable to XML Entity Expansion (XXE) attacks thru 2.61.0. The backend extracts and validates XML files froEPSS 0.3%CVE-2026-23822MEDIUMUnauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of ServiceEPSS 0.3%