1635
<!ENTITY ZERO "A">
<!ENTITY ONE "&ZERO;&ZERO;">
<!ENTITY TWO "&ONE;&ONE;">
...
<!ENTITY THIRTYTWO "&THIRTYONE;&THIRTYONE;">
]>
<data>&THIRTYTWO;</data>
Observed Examples
Reference Description
CVE-2008-3281 XEE in XML-parsing library.
https://www.cve.org/CVERecord?id=CVE-2008-3281
CVE-2011-3288 XML bomb / XEE in enterprise communication product.
https://www.cve.org/CVERecord?id=CVE-2011-3288
CVE-2011-1755 "Billion laughs" attack in XMPP server daemon.
https://www.cve.org/CVERecord?id=CVE-2011-1755
CVE-2009-1955 XML bomb in web server module
https://www.cve.org/CVERecord?id=CVE-2009-1955
CVE-2003-1564 Parsing library allows XML bomb
https://www.cve.org/CVERecord?id=CVE-2003-1564
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1030 OWASP Top Ten 2017 Category A4 - XML External
Entities (XXE)
1026 2437
MemberOf 1349 OWASP Top Ten 2021 Category A05:2021 - Security
Misconfiguration
1344 2493
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 44 XML Entity Expansion
Related Attack Patterns
CAPEC-ID Attack Pattern Name
197 Exponential Data Expansion
References
[REF-676]Amit Klein. "Multiple vendors XML parser (and SOAP/WebServices server) Denial of
Service attack using DTD". 2002 December 6. < https://seclists.org/fulldisclosure/2002/Dec/229
>.2023-04-07.
[REF-677]Rami Jaamour. "XML security: Preventing XML bombs".
2006 February 2. < http://searchsoftwarequality.techtarget.com/
expert/KnowledgebaseAnswer/0,289625,sid92_gci1168442,00.html?
asrc=SS_CLA_302%20%20558&psrc=CLT_92# >.
[REF-678]Didier Stevens. "Dismantling an XML-Bomb". 2008 September 3. < https://
blog.didierstevens.com/2008/09/23/dismantling-an-xml-bomb/ >.2023-04-07.
[REF-679]Robert Auger. "XML Entity Expansion". < http://projects.webappsec.org/w/
page/13247002/XML%20Entity%20Expansion >.2023-04-07.
CWE Version 4.14
CWE-777: Regular Expression without Anchors
CWE-777: Regular Expression without Anchors