Billion Laughs Attack

How the attack works

A billion laughs attack abuses XML entity expansion, usually through nested references that cause a parser to expand a tiny input into an exponentially larger in-memory structure. The danger is not that the XML becomes complex, but that expansion happens during parsing, before the application can apply business logic or size checks.

Because the payload is small, it can bypass naive request-size limits and still create a heavy processing burden. The parser may repeatedly resolve entities until CPU or memory is consumed, which makes this a classic application-layer denial of service pattern rather than a data-exfiltration technique.

Why XML parsers are vulnerable

XML allows entity definitions so documents can reuse text and reference external or internal data. That feature becomes dangerous when a parser permits document type declarations and recursive expansion without strict limits. In practice, the weakness is often in parser configuration, not in XML itself.

This class of attack is especially problematic in systems that accept XML from untrusted sources, such as APIs, legacy integrations, SOAP services, document processors, and file import pipelines. If expansion is enabled by default, a single request can tie up threads, heap space, or downstream worker processes.

Defenders should treat parser defaults as security-relevant. Safe XML handling usually means disabling document type declarations where possible, turning off external entity resolution, and constraining entity expansion or other recursive constructs at the parser or runtime level.

How organisations check exposure

Exposure starts with inventory. Teams need to know which applications, libraries, middleware stacks, and data flows actually parse XML, because the vulnerable component is often not the endpoint that receives the request but the parser buried inside a service or integration layer. The XXE Guide is the most direct internal reference for understanding where XML parser weaknesses, including entity expansion abuse, tend to appear.

Internet-facing XML endpoints deserve priority because attack traffic can be delivered remotely and repeatedly. Legacy SOAP interfaces, SSO assertions, B2B gateways, and document upload features are common places to inspect. Vendor advisories and parser documentation should be checked for whether safe parsing modes are available and enabled.

Exposure review should also include load testing and configuration review, not just vulnerability scanning. A parser may be present but unreachable in practice, or reachable only through a narrow integration path, so asset context matters as much as code-level findings.

Remediation and detection

The most effective remediation is to remove the dangerous parsing behaviour, then verify that the application still functions without recursive expansion. Where XML is unavoidable, use hardened parser settings, apply resource limits, and prefer schemas or formats that do not rely on entity expansion. The Denial of Service at Application Layer Guide is a useful internal companion for understanding per-request limits, timeouts, and graceful degradation as defensive patterns.

Detection is usually indirect. Watch for sudden CPU spikes, heap exhaustion, parser exceptions, worker starvation, and sharp latency increases on endpoints that normally handle small XML payloads. If a service crashes or stalls after receiving a short request, that is a strong signal to inspect parsing controls and request logs.

After patching or reconfiguring, review logs and telemetry for signs that the attack already succeeded in causing outage or repeated retries. In most cases the main consequence is availability loss, but operational impact can cascade into queue buildup, failed integrations, and wider service degradation if the parser sits on a shared path.

Related resources from NHI Mgmt Group

• How can organisations defend against Billion Laughs Attack?
• Which systems are most exposed to a Billion Laughs Attack?
• What breaks when XML parsing is exposed to entity expansion attacks like the billion laughs pattern?
• Why does Agentic AI make NHI attack surface expand so significantly?