Summary
A denial-of-service vulnerability in libexpat allows specially structured XML documents to trigger excessive entity expansion and CPU consumption during parsing. An attacker who can submit XML to an affected parser may cause substantial processing delays or resource exhaustion, particularly when large DTDs and nested entities are accepted.
A denial-of-service vulnerability in libexpat allows specially structured XML documents to trigger excessive entity expansion and CPU consumption during parsing. An attacker who can submit XML to an affected parser may cause substantial processing delays or resource exhaustion, particularly when large DTDs and nested entities are accepted.
Affected context
The issue can occur in applications that use libexpat to parse attacker-influenced XML and permit DTD processing or entity expansion. Risk is higher when XML parsing occurs synchronously, resource limits are weak, or parser protections evaluate entity amplification only after significant computation has already taken place.
The issue can occur in applications that use libexpat to parse attacker-influenced XML and permit DTD processing or entity expansion. Risk is higher when XML parsing occurs synchronously, resource limits are weak, or parser protections evaluate entity amplification only after significant computation has already taken place.
Exploit preconditions
- Attack surface: An application or service that parses XML through libexpat
- Required access: Ability to submit, upload, relay, or otherwise influence XML input
- Trigger point: XML parsing of DTDs and nested entity references
- Why exploitation is possible: Entity expansion and amplification can consume substantial CPU before protective accounting detects the excessive growth
- Attack surface: An application or service that parses XML through libexpat
- Required access: Ability to submit, upload, relay, or otherwise influence XML input
- Trigger point: XML parsing of DTDs and nested entity references
- Why exploitation is possible: Entity expansion and amplification can consume substantial CPU before protective accounting detects the excessive growth
Why this happens
The underlying bug is insufficiently early resource accounting for XML entity expansion. In affected parsing logic, amplification protection in accountingDiffTolerated() may identify excessive expansion only after considerable processing has occurred. This maps to CWE-776: Improper Restriction of Recursive Entity References in DTDs, where nested entity processing can cause disproportionate resource consumption.
The underlying bug is insufficiently early resource accounting for XML entity expansion. In affected parsing logic, amplification protection in accountingDiffTolerated() may identify excessive expansion only after considerable processing has occurred. This maps to CWE-776: Improper Restriction of Recursive Entity References in DTDs, where nested entity processing can cause disproportionate resource consumption.
Potential impact
- A service may experience severe CPU consumption
- XML parsing requests could become slow or time out
- An attacker could cause application-level denial of service
- Shared compute resources may become unavailable to other workloads
- Repeated requests could increase operational and infrastructure costs
- A service may experience severe CPU consumption
- XML parsing requests could become slow or time out
- An attacker could cause application-level denial of service
- Shared compute resources may become unavailable to other workloads
- Repeated requests could increase operational and infrastructure costs
General mitigation guidance
Mitigation generally focuses on reducing trust in XML input and limiting parser resource consumption.
Defensive patterns include:
- Disabling DTD processing and external entity resolution when application requirements permit
- Applying strict limits on document size, nesting depth, entity count, and expansion ratio
- Using parser configurations that enforce resource checks before substantial expansion work
- Processing untrusted XML asynchronously with bounded CPU, memory, and execution time
- Isolating XML parsing workloads and applying least-privilege runtime permissions
- Rejecting unnecessary XML features through schema and input policy enforcement
Mitigation generally focuses on reducing trust in XML input and limiting parser resource consumption.
Defensive patterns include:
- Disabling DTD processing and external entity resolution when application requirements permit
- Applying strict limits on document size, nesting depth, entity count, and expansion ratio
- Using parser configurations that enforce resource checks before substantial expansion work
- Processing untrusted XML asynchronously with bounded CPU, memory, and execution time
- Isolating XML parsing workloads and applying least-privilege runtime permissions
- Rejecting unnecessary XML features through schema and input policy enforcement
How teams detect issues like this
Organizations can look for XML entity expansion risks through:
- Static analysis of parser configuration and entity-resolution settings
- Code review checks for untrusted XML entry points and unrestricted DTD support
- Tests using oversized, deeply nested, or high-expansion XML structures in controlled environments
- Runtime monitoring for abnormal CPU usage, parsing latency, request timeouts, and repeated XML submissions
- Policy enforcement requiring bounded parser settings for externally supplied XML
Automated security review tools may help identify permissive XML parsing configurations and missing resource limits.
Organizations can look for XML entity expansion risks through:
- Static analysis of parser configuration and entity-resolution settings
- Code review checks for untrusted XML entry points and unrestricted DTD support
- Tests using oversized, deeply nested, or high-expansion XML structures in controlled environments
- Runtime monitoring for abnormal CPU usage, parsing latency, request timeouts, and repeated XML submissions
- Policy enforcement requiring bounded parser settings for externally supplied XML
Automated security review tools may help identify permissive XML parsing configurations and missing resource limits.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| vulncheck. | vulncheck.com/ |
