CWE-776: XML entity expansion

Fix it in your stack

Tested fixes for CWE-776 in Flask, Spring Boot and ASP.NET Core: the vulnerable code, the fix, a plausible fix that still fails, and the regression tests.

XML external entity (XXE) processing

What MITRE says

The description above is MITRE’s definition of CWE-776 in CWE 4.20, a base-level weakness.

Common consequences MITRE lists

Availability: DoS: Resource Consumption (Other)

Guides on this site

Cites this weakness · Guide

Parse bounded JSON and XML into an explicit application schema

Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.

Practice

XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
Pickle deserialization lab: Load a session token without pickle · Browser lab
Parse bounded JSON and XML invoices safely · Local project

References

CWE-776 in the MITRE CWE list (version 4.20)

This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-776.

CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.