Denial of Service Vulnerability in OpenNMS Meridian and Horizon

CVE-2026-111252

What is CVE-2026-111252?

A potential denial of service vulnerability has been identified in the XML parsing capabilities of OpenNMS Meridian and Horizon. This issue arises from the lack of effective limits on entity expansion while parsing XML. When provided with a specially crafted document containing a DOCTYPE declaration with internal entities, the XML parser can expand these entities to a size that leads to server memory exhaustion. This vulnerability can be exploited by authenticated users with provisioning access, who can introduce such documents via requisition or foreign-source imports, including a remote requisition URL. The vulnerability is mitigated in newer versions of the software that cap the number of entity expansions during XML parsing and prohibit the use of DOCTYPE declarations in these contexts. Organizations are encouraged to upgrade to versions Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer to safeguard against potential exploitation.

References