Entity Expansion (Billion Laughs) Detection

When to Use

Audit any package that parses XML, SVG, HTML with entity support, or YAML with alias/anchor support. This includes:

• XML/SVG parsing libraries
• Document processors (DOCX, XLSX, RSS, Atom, SOAP)
• YAML parsers with alias expansion
• Configuration file parsers

~90% CVE acceptance rate when confirmed.

Key Insight

Many parsers have NO default entity expansion limit. A 1KB XML payload with recursive entity definitions can expand to 1GB+ in memory, crashing the process with an OOM kill (uncatchable — process dies).

Entity Expansion Types