Governed by the JAXP feature, FEATURE_SECURE_PROCESSING, releases of the JDK prior to 7u45 implemented three limits: entityExpansionLimit, elementAttributeLimit and maxOccurLimit. The purpose of these limits is to allow JAXP processors to detect abnormal XML files that contain malicious DTD constructs, such as that in the billion laugh attack.
While these limits worked as designed, there were issues with the entityExpansionLimit limit. Firstly, the number of entity expansions is just one of two factors affecting the total size of expanded entities that may lead to an out-of-memory situation. The other factor is the size of the entity itself.
Secondly, there are two different types of entities: general and parameter. Unlike general entities that are parsed only when they are referenced, parameter entities need to be processed while they are read, which can result in very large entities when nested references are resolved.
To address these issues, three limits were added to the 7u45 and JDK 8 releases of the JDK to protect applications from malicious attacks such as the billion laugh attack.
Starting from JDK 8 update 11 release, a new property, maxElementDepth, is added to provide applications the ability to set limit on maximum element depth in an xml file that they parse. This may be helpful for applications that use too much of resources when processing an xml file with excessive element depth.