Billion laughs

Last reviewed:

Billion Laughs

The "Billion Laughs" attack, also known as an XML bomb, is a type of denial-of-service (DoS) attack that exploits the extensible markup language (XML) parsers in applications. This attack involves crafting a malicious XML document designed to overwhelm the parser, to excessive memory consumption and potential application failure. As of October 2023, the Billion Laughs attack remains a relevant concern for developers and system administrators who work with XML data. Understanding how this attack works, its applications, and its limitations is crucial for implementing effective security measures.

Overview

The Billion Laughs attack is a well-known vulnerability that targets XML parsers. It is a form of denial-of-service (DoS) attack that exploits the way XML parsers process nested entities. By creating a document with a small number of entities that expand exponentially, the attacker can cause the parser to consume excessive resources, to application slowdown or crash. This attack is particularly effective against systems that do not have proper input validation or resource limits in place.

How it works

The Billion Laughs attack works by leveraging XML entities, which are a way to define shortcuts for longer strings of text in XML documents. An attacker crafts an XML document with entities that reference each other in a nested manner. When the parser processes these entities, it expands them recursively, to exponential growth in memory usage.

For example, an XML document might define an entity named "lol" that consists of ten "lol" entities, each of which consists of another ten "lol" entities, and so on. This recursive expansion can quickly consume all available memory, causing the application to crash or become unresponsive.

Applications

The primary application of the Billion Laughs attack is to disrupt services by causing denial-of-service (DoS) conditions. It is often used against web services, application servers, and any system that processes XML data. Attackers may use this technique to target specific applications or services, causing downtime and potentially to financial or reputational damage.

Limitations

While the Billion Laughs attack can be effective, it has several limitations. Modern XML parsers often include protections against such attacks, such as disabling external entity processing or limiting the depth of entity expansion. Additionally, proper input validation and resource management can mitigate the impact of this attack. Developers are encouraged to use secure parsing libraries and to configure their systems to handle XML data safely.

Billion Laughs Attack Process

Memory Consumption Over Time During Billion Laughs Attack

See also

  • Denial-of-service (DoS) attacks
  • XML vulnerabilities

Sources

Categories: Techniques | Vulnerabilities
Last updated: September 16, 2026