jbossws/jbossws-common · Security
JBossWS vulnerable to uncontrolled recursion
- GHSA ID
- GHSA-rj4p-7mm6-gm9j
- CVE ID
- CVE-2011-1483
- Severity
- low
- Published
- Updated
Description
DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
CWEs
- CWE-400 · Uncontrolled Resource Consumption