{"id":40103,"date":"2026-10-16T04:34:36","date_gmt":"2026-10-15T20:34:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111252"},"modified":"2026-10-16T04:34:36","modified_gmt":"2026-10-15T20:34:36","slug":"cve-2026-111252","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-111252","title":{"rendered":"CVE-2026-111252 [MEDIUM] &#8211; A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNM"},"content":{"rendered":"<p>A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server memory. An authenticated user with provisioning access can supply such a document through a requisition or foreign-source import, which includes a remote requisition URL that the server fetches and parses. Both deeply nested entities and a single large entity referenced many times cause the memory exhaustion. The fix caps the number of entity expansions for all XML parsing and rejects any DOCTYPE in requisition and foreign-source XML.<\/p>\n<p>The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization&#8217;s private networks and should not be directly accessible from the Internet.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a D<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-40103","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/40103","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=40103"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=40103"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=40103"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}