CVE-2016-5300: Uncontrolled Resource Consumption

June 16, 2016 (updated January 23, 2019)

The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document.

References

www.securityfocus.com/bid/91159
nvd.nist.gov/vuln/detail/CVE-2016-5300

Code Behaviors & Features

Detect and mitigate CVE-2016-5300 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →