Headline
GHSA-2jx7-xg83-j2m7: Zendframework Denial of Service vector via XEE injection
Zend_Dom
, Zend_Feed
, Zend_Soap
, and Zend_XmlRpc
are vulnerable to XML Entity Expansion (XEE) vectors, leading to Denial of Service vectors. XEE attacks occur when the XML DOCTYPE declaration includes XML entity definitions that contain either recursive or circular references; this leads to CPU and memory consumption, making Denial of Service exploits trivial to implement.
Zendframework Denial of Service vector via XEE injection
High severity GitHub Reviewed Published Jun 7, 2024 to the GitHub Advisory Database • Updated Jun 7, 2024