jabberd: DoS via the XML "billion laughs attack"
Published Jun 21, 2011
7.5
HIGHCVSS 3.1
EPSS 3.66%
Description
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
Affected products
No data.
Configuration 2
- 13
- 14
- 15
Configuration 3
- < 10.6.8
- ≥ 10.7.0 · < 10.7.2
- < 10.6.8
- ≥ 10.7.0 · < 10.7.2
No data.
Red Hat Network Proxy v 5.4
jabberd-0:2.2.8-12.el5sat
Fixed · RHSA-2011:0881
Red Hat Network Satellite Server v 5.4
jabberd-0:2.2.8-12.el5sat
Fixed · RHSA-2011:0882
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Network Proxy v 5.4 | jabberd-0:2.2.8-12.el5sat | Fixed | RHSA-2011:0881 |
| Red Hat Network Satellite Server v 5.4 | jabberd-0:2.2.8-12.el5sat | Fixed | RHSA-2011:0882 |
No package ranges for this CVE.
Remediation
Red Hat statement
Vulnerable. This issue has been addressed in Red Hat Network Satellite Server v 5.4.1 via RHSA-2011:0882 https://rhn.redhat.com/errata/RHSA-2011-0882.html and in Red Hat Network Proxy Server v5.4.1 via RHSA-2011:0881 https://rhn.redhat.com/errata/RHSA-2011-0881.html. This issue is not planned to be fixed in Red Hat Network Satellite Server versions 5.0.2, 5.1.1, 5.2.1, 5.3.0 and not planned to be fixed in Red Hat Network Proxy Server versions 5.0.2, 5.1.1, 5.2.1, and 5.3.0.
Metrics
No CVSS v4.0 score for this CVE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
AV:N/AC:L/Au:N/C:N/I:N/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2022–2026- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (13 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 3.66% (0.03659) | 89.26th | v5 (v2026.06.15) |
| Jun 15, 2026 | 3.66% (0.03659) | 88.14th | v5 (v2026.06.15) |
| Mar 30, 2025 | 8.46% (0.08459) | 91.52th | v4 (v2025.03.14) |
| Mar 29, 2025 | 18.63% (0.18626) | 92.20th | v4 (v2025.03.14) |
| Mar 25, 2025 | 8.46% (0.08459) | 91.47th | v4 (v2025.03.14) |
| Mar 17, 2025 | 6.24% (0.06243) | 90.20th | v4 (v2025.03.14) |
| Dec 17, 2024 | 5.75% (0.05750) | 93.26th | v3 (v2023.03.01) |
| Feb 3, 2024 | 8.13% (0.08134) | 93.75th | v3 (v2023.03.01) |
| Nov 8, 2023 | 8.71% (0.08710) | 93.86th | v3 (v2023.03.01) |
| Mar 7, 2023 | 6.44% (0.06445) | 92.55th | v3 (v2023.03.01) |
| Mar 6, 2023 | 3.78% (0.03779) | 85.48th | v2 (v2022.01.01) |
| Apr 1, 2022 | 3.78% (0.03779) | 84.01th | v2 (v2022.01.01) |
| Feb 4, 2022 | 3.78% (0.03779) | 67.21th | v2 (v2022.01.01) |
References (19)
- http://codex.xiaoka.com/svn/jabberd2/tags/jabberd-2.2.14/ChangeLog x_refsource_CONFIRMBroken Link
- http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html vendor-advisoryx_refsource_APPLEMailing List
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061341.html vendor-advisoryx_refsource_FEDORAMailing List
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061458.html vendor-advisoryx_refsource_FEDORAMailing List
- http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061482.html vendor-advisoryx_refsource_FEDORAMailing List
- http://secunia.com/advisories/44787 third-party-advisoryx_refsource_SECUNIABroken LinkVendor Advisory
- http://secunia.com/advisories/44957 third-party-advisoryx_refsource_SECUNIABroken Link
- http://secunia.com/advisories/45112 third-party-advisoryx_refsource_SECUNIABroken Link
- http://support.apple.com/kb/HT5002 x_refsource_CONFIRMThird Party Advisory
- http://www.mail-archive.com/jabberd2%40lists.xiaoka.com/msg01655.html mailing-listx_refsource_MLISTRelease Notes
- http://www.redhat.com/support/errata/RHSA-2011-0881.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.redhat.com/support/errata/RHSA-2011-0882.html vendor-advisoryx_refsource_REDHATBroken Link
- http://www.securityfocus.com/bid/48250 vdb-entryx_refsource_BIDBroken LinkThird Party AdvisoryVDB Entry
- https://access.redhat.com/security/cve/CVE-2011-1755 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=700390 x_refsource_CONFIRMIssue TrackingPatch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67770 vdb-entryx_refsource_XFThird Party AdvisoryVDB Entry
- https://hermes.opensuse.org/messages/9197650 vendor-advisoryx_refsource_SUSEBroken Link
- https://nvd.nist.gov/vuln/detail/CVE-2011-1755
- https://www.cve.org/CVERecord?id=CVE-2011-1755
Change history (0)
No recorded changes yet.