CVE-2019-5427 - AskarLabs CVE Database

CVE-2019-5427

Vendor N/A

Product c3p0

Weakness CWE-776

Published April 22, 2019

Last update August 4, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.

Key dates

02Disclosure timeline

April 22, 2019 CVE published

August 4, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2019-5427 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/776.html

Related vulnerabilities

04Related CVE

CVE-2023-28118 kaml has potential denial of service while parsing input with anchors and aliases CVE-2026-26278 fast-xml-parser affected by DoS through entity expansion in DOCTYPE (no expansion limit) CVE-2022-34467 CVE-2026-45771 Freeswitch Denial-of-Service in SIP PUBLISH Requests via XML Entity Expansion CVE-2020-5227 Feedgen Vulnerable to XML Denial of Service Attacks