CVE-2019-12401

CVE-2019-12401: XML Bomb in Apache Solr Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack a.k.a. Lol Bomb via its update handler. By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

CVE-2023-46035

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

EUVD-2023-60669

The svgoptimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents...

XXE-Payloads

XXE-Payloads Quick access to XXE Payloads XXE: root@kitploit: %sp;...

EUVD-2026-65227

NLTK: Entity-expansion DoS billion laughs via remaining raw ElementTree parses...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

Apicurio/apicurio-registry: apicurio-registry: XML entity-expansion denial of service via internal DTD subset

A flaw was found in Apicurio Registry. The DocumentBuilderAccessor correctly blocks external DTD and schema access but does not disable DOCTYPE declarations or enable FEATURESECUREPROCESSING. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloa...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

DEBIAN-CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681 NLTK before 3.10.3 Entity Expansion DoS via ElementTree

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681 NLTK before 3.10.3 Entity Expansion DoS via ElementTree

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

CVE-2026-78681

NLTK versions before 3.10.3 are vulnerable to a denial of service via XML entity expansion. The library uses xml.etree.ElementTree to parse XML in multiple modules, and this parser honors entity declarations in document DTDs. An attacker can supply a crafted XML payload containing nested entity d...

PT-2026-81156

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.3 Description Multiple modules use the xml.etree.ElementTree library to parse XML, which honors entity declarations in document DTDs Document Type Definitions. This allows attackers to craft XML payloads with nested...

Linux Distros Unpatched Vulnerability : CVE-2026-78681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft X...

CVE-2026-78681

NLTK versions before 3.10.3 use xml.etree.ElementTree to parse XML in multiple modules, which honors entity declarations in document DTDs. Attackers can craft XML payloads with nested entity declarations that expand from hundreds of bytes to megabytes in memory, causing denial of service...

assertj: AssertJ: Information disclosure and denial of service via XML External Entity (XXE)

A flaw was found in AssertJ. An XML External Entity XXE vulnerability exists in the XmlStringPrettyFormatter component, which is used by the isXmlEqualToCharSequence assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read...

Astra Linux – Vulnerability in c3p0

C3P0 versions less than 0.9.5.4 may be exploited by a “billion laughs attack” when loading XML configuration, due to the lack of protections against recursive entity expansion during the loading of configuration files...