CWE-776 (DTD中递归实体索引的不恰当限制(XML实体扩展)) — Vulnerability Class 33

33 vulnerabilities classified as CWE-776 (DTD中递归实体索引的不恰当限制(XML实体扩展)). AI Chinese analysis included.

CWE-776 represents a critical input validation weakness where applications fail to restrict recursive entity references within Document Type Definitions (DTDs). Attackers typically exploit this vulnerability by crafting malicious XML payloads containing deeply nested or circular entity definitions. When the parser processes these structures, it triggers an exponential expansion of data, rapidly consuming available memory and CPU resources. This uncontrolled growth leads to a denial of service, effectively crashing the application or rendering the server unresponsive to legitimate users. To mitigate this risk, developers must implement strict limits on entity expansion depth and disable DTD processing entirely when not required. Utilizing secure XML parsers that enforce resource constraints and validating input against known safe schemas are essential practices for preventing XML entity expansion attacks and ensuring system stability.

MITRE CWE Description

The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities. If the DTD contains a large number of nested or recursive entities, this can lead to explosive growth of data when parsed, causing a denial of service.

Common Consequences (1)

Availability DoS: Resource Consumption (Other)

If parsed, recursive entity references allow the attacker to expand data exponentially, quickly consuming all system resources.

Mitigations (2)

Operation If possible, prohibit the use of DTDs or use an XML parser that limits the expansion of recursive DTD entities.

Implementation Before parsing XML files with associated DTDs, scan for recursive entity declarations and do not continue parsing potentially explosive content.

Examples (1)

The DTD and the very brief XML below illustrate what is meant by an XML bomb. The ZERO entity contains one character, the letter A. The choice of entity name ZERO is being used to indicate length equivalent to that exponent on two, that is, the length of ZERO is 2^0. Similarly, ONE refers to ZERO twice, therefore the XML parser will expand ONE to a length of 2, or 2^1. Ultimately, we reach entity …

<?xml version="1.0"?> <!DOCTYPE MaliciousDTD [ <!ENTITY ZERO "A"> <!ENTITY ONE "&ZERO;&ZERO;"> <!ENTITY TWO "&ONE;&ONE;"> ... <!ENTITY THIRTYTWO "&THIRTYONE;&THIRTYONE;"> ]> <data>&THIRTYTWO;</data>

Attack · XML

CVE ID	Title	CVSS	Severity	Published
CVE-2020-5227	Feedgen Vulnerable to XML Denial of Service Attacks — python-feedgen	4.4	Medium	2020-01-28
CVE-2019-5442	Pippo 资源管理错误漏洞 — Pippo	7.5	-	2019-06-12
CVE-2019-5427	c3p0 资源管理错误漏洞 — c3p0	7.5	-	2019-04-22

Vulnerabilities classified as CWE-776 (DTD中递归实体索引的不恰当限制(XML实体扩展)) represent 33 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.