PVD-20260518-E9B1: XXE and Unbounded Entity Expansion in XML/Ada

Fixed by Vendor
← All Disclosures

Summary

XML/Ada's SAX parser resolved external entities by default, while its advertised switches for disabling them had no effect. An application parsing attacker-controlled XML could disclose local files or exhaust CPU and memory through exponential entity expansion. DOM and other readers built on the SAX parser inherited the same risk.

Affected: XML/Ada before 27.0.
Fixed: XML/Ada 27.0 and later; AdaCore's fixed wavefront builds begin with 20260615. AdaCore reports no workaround for earlier releases.

Demonstration

A short document was enough to read a file available to the parser process:

<!DOCTYPE root [
  <!ENTITY xxe SYSTEM "secret.txt">
]>
<root>&xxe;</root>

Vulnerable releases inserted the contents of secret.txt even after both external-entity features were set to False. A nested-entity document also caused unbounded expansion.

How Pragmatic Found It

Pragmatic's SAXExpansion checker highlighted code using Sax.Readers without disabling entity resolution. Following that path into XML/Ada showed that the two standard feature flags were stored but never checked; a small proof of concept confirmed file disclosure and expansion denial of service.

The Fix

AdaCore made the external general- and parameter-entity switches effective, added controls for external DTDs and DOCTYPE, and added limits for entity count and total expanded size. Applications that parse untrusted XML should upgrade and enable the appropriate restrictions.

Acknowledgements

Thank you to AdaCore for taking the report seriously, fixing XML/Ada, publishing a clear advisory, and crediting the reporter. Particular thanks to Vadim Godunko for the fix series, and to Thomas Serabian and Frédéric Léger for the advisory and review.

Severity

AdaCore CVSS 3.1: 9.1 (Critical)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:P/RL:U/RC:C

References

Disclosure Timeline