CVE-2026-111252 in Meridian
Summary
by MITRE • 10/15/2026
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server memory. An authenticated user with provisioning access can supply such a document through a requisition or foreign-source import, which includes a remote requisition URL that the server fetches and parses. Both deeply nested entities and a single large entity referenced many times cause the memory exhaustion. The fix caps the number of entity expansions for all XML parsing and rejects any DOCTYPE in requisition and foreign-source XML.
The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The identified vulnerability represents a critical denial of service flaw rooted in the insecure handling of XML entity expansion within OpenNMS Meridian and Horizon platforms. This issue, classified under CWE-776 as Improper Tracking of Entity Expansion or ReDoS-related memory exhaustion depending on specific implementation details, allows an attacker to trigger catastrophic resource consumption by exploiting the lack of effective limits on how many times internal entities can be expanded during parsing. When a malicious XML document containing a DOCTYPE declaration with internally defined entities is processed, the parser recursively expands these entities without restriction. This behavior leads to exponential growth in memory usage as deeply nested structures or single large entities referenced multiple times are resolved, ultimately exhausting available server memory and causing the application to crash or become unresponsive.
The attack vector specifically targets authenticated users who possess provisioning access privileges within the OpenNMS environment. Such a user can inject malicious XML payloads through standard operational workflows such as importing foreign sources or submitting requisitions that include remote URLs for fetching configuration data. The system automatically retrieves and parses these external resources, providing an indirect but effective path for exploitation without requiring direct network-level access to the parsing engine itself. This highlights a significant risk in environments where internal trust boundaries are not strictly enforced between administrative functions and underlying parser libraries. From a tactical perspective, this aligns with ATT&CK technique T1496 Resource Hijacking or potentially T1059 Command and Scripting Interpreter if viewed through the lens of resource exhaustion leading to service disruption, though it is primarily categorized as a denial-of-service event rather than remote code execution in its current manifestation.
The operational impact of this vulnerability extends beyond simple availability loss; it can lead to cascading failures within network monitoring infrastructures that rely on OpenNMS for continuous data ingestion and alerting. Since the service may become unresponsive, critical alerts could be missed during periods of high load or when administrators attempt to remediate other issues simultaneously. Furthermore, repeated exploitation attempts could degrade system performance even if full exhaustion is not achieved immediately, leading to latency in dashboard updates and delayed incident response capabilities for security operations teams dependent on real-time visibility.
Mitigation strategies prioritize immediate software upgrades as the primary defense mechanism. Organizations running affected versions must upgrade to Meridian 2024.3.14, 2025.0.11, or 2026.0.1, and Horizon version 36.0.5 or newer. These updated releases implement strict caps on the number of entity expansions allowed during XML parsing and explicitly reject any DOCTYPE declarations within requisition and foreign-source XML files, thereby neutralizing the attack vector at the parser level. In addition to patching, administrators should enforce rigorous input validation policies for all provisioning endpoints and ensure that only trusted internal sources are permitted as remote URLs in configuration imports. Given that OpenNMS installations are typically designed for private network environments rather than direct internet exposure, maintaining strong perimeter defenses and restricting administrative access via multi-factor authentication further reduces the likelihood of successful exploitation by external threat actors or compromised insider accounts.