Detailedlikelihood: Highseverity: MediumDraft
CAPEC-197Exponential Data Expansion
Abstraction
Detailed
Status
Draft
Likelihood
High
Severity
Medium
Description
An adversary submits data to a target application which contains nested exponential data expansion to produce excessively large output. Many data format languages allow the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
Related weaknesses· 2
Related attack patterns· 1
Exploits2
| Type | Target | Confidence | Tier |
|---|---|---|---|
| Weakness | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')cwe-776 | 100% | live |
| Weakness | Allocation of Resources Without Limits or Throttlingcwe-770 | 100% | live |
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.