What’s Vulnerable › Vulnerabilities
CVE-2019-5442
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.4% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2019-06-12 · updated 2026-06-17
- Weakness: CWE-776
Description
XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.
Affected products
- Pippo: 1.12.0
References
Get alerted when CVE-2019-5442 or the next vulnerability affects your stack