CVE-2026-111252: CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') in The OpenNMS Group Meridian

This vulnerability (CVE-2026-111252) involves improper restriction of recursive entity references in XML Document Type Definitions (DTDs) within OpenNMS Meridian and Horizon. The XML parser does not effectively limit entity expansion, enabling an authenticated user with provisioning privileges to supply XML documents containing DOCTYPE declarations with internal entities that expand excessively. This can exhaust server memory, resulting in denial of service. The attack vector includes supplying such XML through requisitions or foreign-source imports, where the server fetches and parses remote requisition URLs. The issue affects versions prior to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5. The vendor fixed the issue by capping entity expansions and rejecting DOCTYPE declarations in these XML inputs.

Successful exploitation leads to denial of service by exhausting server memory during XML parsing. There is no impact on confidentiality or integrity. The attack requires authenticated provisioning access, limiting exposure. The vulnerability can disrupt service availability but does not allow code execution or data leakage.

The vendor has released official fixes in Meridian versions 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 and later. Users should upgrade to these versions or newer to remediate the vulnerability. The vendor also advises that these products are intended for private network installation and should not be exposed directly to the Internet. Patch status is confirmed by the vendor advisory.