CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
AI Translation Available
The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
Status
draft
Abstraction
base
Likelihood
medium
Affected Platforms
Not Language-Specific
XML
Extended Description
AI Translation
If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
Technical Details
AI Translation
Common Consequences
availability
Impacts
dos: resource consumption (other)
Detection Methods
automated static analysis
Potential Mitigations
Phases:
operation
implementation
Descriptions:
•
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
•
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.