cwe-776-xml-entity-expansion

To fix a billion laughs vulnerability in Java XML parsing, you must disable DTDs, enable secure processing, and disallow entity reference expansion in `DocumentBuilderFactory` to prevent denial-of-service attacks via malicious XML entities.

CWE-776 XML entity expansion is a denial-of-service attack, known as the billion laughs attack, where malicious XML entities exponentially expand during parsing, overwhelming Java applications that use `DocumentBuilderFactory` and causing data leakage or system crashes.

You can secure `DocumentBuilderFactory` against XML entity attacks by applying configurations that disable DTDs entirely, enable secure processing features, and explicitly disallow entity reference expansion to remediate CWE-776 vulnerabilities.

Yes, you can automatically refactor Java code flagged by SAST tools for XML entity expansion by applying deterministic fixes that implement secure configurations for `DocumentBuilderFactory`, disallowing DTDs and entity expansion to ensure robust XML processing security.

Disabling DTDs prevents XML entity expansion attacks in Java because DTDs define the malicious entity references that trigger exponential expansion, so blocking them stops the billion laughs attack vector from executing during `DocumentBuilderFactory` parsing.