The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
View on MITREIf the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources.
If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.
Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
No detection method information available for this CWE.
The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity contains one character, the letter A. The choice of entity name ZERO is being used to indicate length equivalent to that exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or 2^1. Ultimately, we reach entity THIRTYTWO, which will expand to 2^32 characters in length, or 4 GB, probably consuming far more data than expected.
CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.
If exploited, CWE-776 (Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')) it can compromise Availability, leading to outcomes such as DoS: Resource Consumption (Other).
Recommended mitigations for CWE-776 include: If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities. Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.
CWE-776 commonly affects XML. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.
MITRE documents real CVEs mapped to CWE-776, including CVE-2008-3281, CVE-2011-3288, CVE-2011-1755, CVE-2009-1955 and CVE-2003-1564. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.
A CWE (Common Weakness Enumeration) like CWE-776 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.