CVE-2003-1564: xmlsoft libxml2 XML Entity Expansion

Vulnerability summary

CVE-2003-1564 is a high (CVSS 9.3) XML Entity Expansion vulnerability in xmlsoft libxml2. EPSS estimates a 1.62% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities.

Timeline

1. 02-09-2008
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."

• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.