Executive brief
Apache Sling XSS, a cross-site scripting protection library, contains a vulnerability that fails to restrict recursive XML entity references in document type definitions. An attacker could exploit this by crafting a malicious XML document with nested entity definitions to consume excessive server resources, causing a denial of service. Organizations using Sling XSS for web security should upgrade immediately.
Technical details
The vulnerability is an improper restriction of recursive entity references in DTDs (XML entity expansion or "billion laughs" attack) affecting the XML parsing functionality. The issue allows an unauthenticated attacker with network access to submit a specially crafted XML document that triggers exponential entity expansion, consuming CPU and memory resources and denying service to legitimate users. The fix was introduced in version 2.4.12.
Affected products
- Apache Sling XSS before 2.4.12
Timeline
- 2026-09-23: disclosed