Skip to main content

XML error · entity

Detected an entity reference loop

Two declared entities refer to each other in a cycle. The parser stops rather than expand forever — the same guard that blocks a billion-laughs attack.

Detected an entity reference loop

What it means

An entity whose replacement text references an entity that references it back has no finite expansion. libxml2 detects the cycle and refuses the document instead of consuming memory until it dies.

This is the benign face of a hostile pattern. The billion-laughs denial-of-service works by nesting entities so each level multiplies the last; the same recursion guard stops both, which is why an XML parser handling untrusted input must have one.

This message carries no line number. The cycle is a property of the declarations taken together, not of a single position in the file.

What usually causes it

  • Hand-written DTD entities that reference one another, directly or through a chain.
  • Merging two internal DTD subsets that each define an entity in terms of the other's.
  • A generated DTD where entity definitions are emitted from an unordered map.
  • Deliberately hostile input: a billion-laughs payload aimed at an XML endpoint.

How to fix it

  • Break the cycle — an entity's replacement text must not lead back to itself.
  • Prefer numeric character references or literal UTF-8 to custom entities; most documents need none.
  • For untrusted input, disable DTD processing entirely rather than relying on the recursion guard.
  • Keep entity definitions in one place so a cycle is visible when reading them.

The same error elsewhere

Different parsers, same defect. If you arrived with one of these messages, you are in the right place.

  • Xerces (Java)

    Recursive reference "&a;". (Reference path: a -> b -> a)
  • expat (Python)

    recursive entity reference: line 3, column 6
  • .NET System.Xml

    Entities cannot be recursive.

Before and after

Both snippets are re-checked by the test suite against the real parser: the first is confirmed to produce the exact error above, the second to parse cleanly.

Fails
<?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY a "&b;"><!ENTITY b "&a;">]>
<root>&a;</root>
Parses
<?xml version="1.0"?>
<!DOCTYPE root [<!ENTITY a "expanded">]>
<root>&a;</root>

Where this bites most

Get started

Bring order to the XML your team can't afford to ignore.

Create a free account and get a private workspace to search, validate, diff, and monitor your XML feeds, sitemaps, schemas, and vendor integrations.