cwe-776-xml-entity-expansion

Remediate CWE-776 XML Entity Expansion vulnerabilities in Java XML parsing code.

3|1|Updated Mar 6, 2026

Search Tags:#security #remediation #java #xml #cwe-776 #billion laughs

Ready to run

npx skills add https://github.com/DevelopersCoffee/java-cwe-security-skills --skill cwe-776-xml-entity-expansion

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: cwe-776-xml-entity-expansion
Source: https://github.com/DevelopersCoffee/java-cwe-security-skills/tree/main/cwe-776-xml-entity-expansion
Command: npx skills add https://github.com/DevelopersCoffee/java-cwe-security-skills --skill cwe-776-xml-entity-expansion

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill addresses critical security vulnerabilities in Java applications related to XML Entity Expansion, commonly known as the "Billion Laughs" attack, preventing denial-of-service and data leakage.

Core Features & Use Cases

Vulnerability Remediation: Provides deterministic fixes for CWE-776.
Secure XML Parsing: Implements secure configurations for DocumentBuilderFactory to disallow DTDs and entity expansion.
Use Case: Automatically refactor Java code snippets identified by SAST tools as vulnerable to XML Entity Expansion, ensuring robust security in XML processing.

Quick Start

Use the cwe-776-xml-entity-expansion skill to secure the provided Java XML parsing code.

Frequently Asked Questions about cwe-776-xml-entity-expansion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I fix a billion laughs vulnerability in Java XML parsing?▼

To fix a billion laughs vulnerability in Java XML parsing, you must disable DTDs, enable secure processing, and disallow entity reference expansion in `DocumentBuilderFactory` to prevent denial-of-service attacks via malicious XML entities.

What is CWE-776 XML entity expansion and how does it affect Java applications?▼

CWE-776 XML entity expansion is a denial-of-service attack, known as the billion laughs attack, where malicious XML entities exponentially expand during parsing, overwhelming Java applications that use `DocumentBuilderFactory` and causing data leakage or system crashes.

How do I securely configure DocumentBuilderFactory to prevent XML entity attacks?▼

You can secure `DocumentBuilderFactory` against XML entity attacks by applying configurations that disable DTDs entirely, enable secure processing features, and explicitly disallow entity reference expansion to remediate CWE-776 vulnerabilities.

Can I automatically refactor vulnerable Java code flagged by SAST tools for XML entity expansion?▼

Yes, you can automatically refactor Java code flagged by SAST tools for XML entity expansion by applying deterministic fixes that implement secure configurations for `DocumentBuilderFactory`, disallowing DTDs and entity expansion to ensure robust XML processing security.

Why does disabling DTDs prevent XML entity expansion attacks in Java?▼

Disabling DTDs prevents XML entity expansion attacks in Java because DTDs define the malicious entity references that trigger exponential expansion, so blocking them stops the billion laughs attack vector from executing during `DocumentBuilderFactory` parsing.