XML error reference · XV030
Entity expansion limit exceeded
Nested entity definitions expand to far more text than the source document contains.
What your parser calls it
The same problem, reported differently by each parser. If you arrived here from one of these strings, you are in the right place.
| Parser | Message |
|---|---|
| libxml2 / xmllint | Maximum entity amplification factor exceeded |
| Java SAXParser | JAXP00010001: The parser has encountered more than "64000" entity expansions |
What causes it
The "billion laughs" attack defines an entity referencing ten copies of a smaller entity, ten levels deep. The source is under a kilobyte; fully expanded it is roughly a gigabyte of text, and a parser that expands entities eagerly and without a budget will exhaust memory. A quadratic variant achieves a similar effect with a single large entity referenced many times.
See it happen
<?xml version="1.0"?>
<!DOCTYPE lolz [
<!ENTITY lol "lol">
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz><lolz>lol lol lol</lolz>How to fix it
This document was rejected before expansion, which is the correct outcome. If you are hardening a parser of your own: disable entity substitution where you can, and where you cannot, set an amplification limit. libxml2 exposes `xmlCtxtSetMaxAmplification`, Java has `FEATURE_SECURE_PROCESSING`, and Python's `defusedxml` blocks it outright.
Fix your own document
Paste your own document below. Press Sample if you want the broken example above loaded instead. Nothing you paste leaves this tab.
XML Validator
Well-formedness and schema validation. Nothing is uploaded.
Everything runs in this tab. Nothing you paste is uploaded, logged or sent anywhere. Open your network panel and check.