Read the docs
TI-2021-12292 Aliases CVE-2021-32623GHSA-9gwx-9cwp-5c2m

Opencast vulnerable to billion laughs attack (XML bomb)

Priority LOW 38CWE-776Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using a single HTTP request. To exploit this, users need to have ingest privileges, limiting the group of potential attackers The problem has been fixed in Opencast 9.6. There is no known workaround for this issue.

Why it matters now

EPSS 0.01254 69th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed opencast (opencast): 9.6org.opencastproject:opencast-kernel (Maven): 9.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
opencastopencastbefore 9.69.6Patch availableCNA
—org.opencastproject:opencast-kernel (Maven)before 9.69.6Patch availableGHSA-9gwx-9cwp-5c2m
  • opencast Vendoropencast Affected before 9.6 Fixed in 9.6 Patch available CNA
  • org.opencastproject:opencast-kernel (Maven) Vendor— Affected before 9.6 Fixed in 9.6 Patch available GHSA-9gwx-9cwp-5c2m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:*before 9.6VulnerableApereo
  • cpe:2.3:a:apereo:opencast:*:*:*:*:*:*:*:* Versions before 9.6 Vulnerable ·Apereo

Remediation

  • Fix · CNA opencast (opencast) Fixed in 9.6
  • Fix · GHSA-9gwx-9cwp-5c2m org.opencastproject:opencast-kernel (Maven) Fixed in 9.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32623
  2. 2026-10-03 Alias added: GHSA-9gwx-9cwp-5c2m

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2026-54099 Paella Player: Stored XSS via caption cue text CVSS 3.1HIGH 8.7
  • TI-2026-54098 Opencast: Session fixation in login enables account takeover via crafted link CVSS 3.1HIGH 8.8
  • TI-2021-19627 Files Accessible to External Parties in Opencast CVSS 3.1CRITICAL 9.9
  • TI-2025-38256 Opencast's editor accidentally publishes videos/overwrites publications #1626 CVSS 4.0LOW 2.3
  • TI-2020-04262 Authentication Bypass For Endpoints With Anonymous Access in OpenCast CVSS 3.1CRITICAL 10.0
  • TI-2017-14534 Opencast 2.3.2 and older versions are vulnerable to script injections through media and… CVSS 3.0HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences