How to Protect Against Billion Laughs Attacks

Billion Laughs Attack Protection

A Billion Laughs attack is an XML denial-of-service technique where nested entity definitions expand exponentially in memory, crashing the parser. Unlike XXE, it uses only internal entities — no outbound call is made.

How Check Point WAF Protects Against This

• XXE Blocking — natively blocks malicious DTD/entity abuse

• Body Size Limit — rejects oversized payloads before parsing begins, preventing entity expansion from consuming memory

Configuration

Go to WAF Portal → Your Application → Advanced Settings → Size Limits and set:

• Body Size (Kilobytes) — keep this as low as your application allows

• Max Object Depth — limits XML/JSON nesting depth