cpe:2.3:a:checkstyle:checkstyle:8.11:*:*:*:*:*:*:*

cpe:2.3:a:checkstyle:checkstyle:8.12:*:*:*:*:*:*:*

cpe:2.3:a:checkstyle:checkstyle:8.13:*:*:*:*:*:*:*

cpe:2.3:a:checkstyle:checkstyle:8.14:*:*:*:*:*:*:*

cpe:2.3:a:checkstyle:checkstyle:8.15:*:*:*:*:*:*:*

cpe:2.3:a:checkstyle:checkstyle:8.16:*:*:*:*:*:*:*

cpe:2.3:a:checkstyle:checkstyle:8.17:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*

This attack takes advantage of the entity replacement property of XML where the value of the replacement is a URI. A well-crafted XML document could have the entity refer to a URI that consumes a large amount of resources to create a denial of service condition. This can cause the system to either freeze, crash, or execute arbitrary code depending on the URI.