CVE-2015-5312

What it actually does

The xmlStringLenDecodeEntities function in libxml2 fails to limit recursive entity expansion during XML parsing, allowing crafted input to trigger unbounded CPU consumption and denial of service.

Why it matters to the business

Services and applications that parse untrusted XML can experience sudden resource exhaustion, leading to outages, degraded performance, and operational disruption across many operating systems and products that bundle the library.

How an attack unfolds

An attacker identifies an endpoint or process that accepts XML data, crafts a malicious document containing recursive entity references, and submits it to the vulnerable parser; the parser expands the entities repeatedly, exhausting CPU resources and causing denial of service.

How to fix it

Upgrade libxml2 to version 2.9.3 or later on all affected systems; rebuild or reinstall dependent packages after the library update and verify the new version is in use.

How to confirm the fix worked

Query the installed libxml2 version string and compare against 2.9.3; run regression tests with known entity-expansion test cases to confirm the parser now terminates expansion.

Typical attack path

1. Locate a service or application that accepts and parses XML input
2. Construct an XML document containing deeply nested or recursive entity definitions
3. Submit the crafted XML through the normal input channel
4. Observe sustained high CPU usage and service degradation or unavailability

How to detect it

Monitor process CPU utilization and XML parsing logs for sudden spikes or repeated large entity expansions; correlate with inbound XML traffic volumes.

What your security team should do

• Prioritize patching libxml2 to 2.9.3 or newer on all systems
• Apply network or application-level XML schema validation to reject excessive entity references
• Enable resource limits or timeouts on XML-parsing processes to contain CPU exhaustion
• Review and replace any remaining uses of outdated XML libraries in the environment