CWE-776 (DTD中递归实体索引的不恰当限制(XML实体扩展)) — Vulnerability Class 32

CWE-776 represents a critical input validation weakness where applications fail to restrict recursive entity references within Document Type Definitions (DTDs). Attackers typically exploit this vulnerability by crafting malicious XML payloads containing deeply nested or circular entity definitions. When the parser processes these structures, it triggers an exponential expansion of data, rapidly consuming available memory and CPU resources. This uncontrolled growth leads to a denial of service, effectively crashing the application or rendering the server unresponsive to legitimate users. To mitigate this risk, developers must implement strict limits on entity expansion depth and disable DTD processing entirely when not required. Utilizing secure XML parsers that enforce resource constraints and validating input against known safe schemas are essential practices for preventing XML entity expansion attacks and ensuring system stability.