CVE-2021-32623: Open Source Vulnerability in org.opencastproject:opencast-kernel - Billion laughs attack (XML bomb)
Summary
CVE-2021-32623: Billion laughs attack (XML bomb). Affects org.opencastproject:opencast-kernel versions < 9.6. Fixed in 9.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.opencastproject:opencast-kernel package is a component of Opencast, an open-source system for managing and distributing audiovisual content. It provides functionality for creating and managing media packages. Opencast is vulnerable to a Billion laughs attack, also known as an XML bomb. This attack allows an attacker to execute a denial of service attack by sending a single HTTP request that consumes a large amount of memory, potentially taking down the Opencast system.
Vulnerability Detail
The Billion laughs attack in Opencast is triggered when an XML file with a specific structure is processed by the system. The XML file contains entities that reference other entities, resulting in exponential expansion of the XML content. In this case, the XML file includes a reference to the 'lol' entity, which is recursively expanded multiple times. This causes the system to consume a significant amount of memory, leading to a denial of service condition. The attack can be executed by users with ingest privileges. While Opencast limits the expansion to 100,000 times, it can still cause harm to the system.
How To Fix
Latest published version: 18.5 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
Opencast installations running versions prior to 9.6 are vulnerable to a Billion laughs attack, which can result in a denial of service condition. Upgrading to Opencast 9.6 or later is recommended to mitigate the risk. There is no known workaround for this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencastproject:opencast-kernel →
FAQ
A Billion laughs attack is a type of denial of service attack that exploits the recursive expansion of entities in XML files. By referencing entities that expand exponentially, an attacker can cause a system to consume excessive memory and become unresponsive.
Opencast installations running versions prior to 9.6 are affected by this vulnerability. Users with ingest privileges are capable of executing the attack.
Yes, this vulnerability can be exploited remotely by sending a specially crafted HTTP request containing the malicious XML file.
Opencast limits the expansion of entities to 100,000 times, which reduces the impact of the attack. However, this can still cause harm to the system.
Yes, the vulnerability has been fixed in Opencast version 9.6. It is recommended to upgrade to this version or later to address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.opencastproject:opencast-kernel.
