thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

XML Bomb

A small XML document using nested entity expansion to consume huge amounts of memory and crash the parser.

Definition

The classic Billion Laughs attack defines entities that each reference the previous one multiple times, expanding exponentially. Mitigations include disabling DTD processing, limiting entity expansion and capping document size.

Example

A 1 KB XML file expands to gigabytes in memory when parsed with entity expansion enabled.

Exam tip

Also called Billion Laughs; it is a denial-of-service, not data theft.

Related terms