---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable \[Updated in Security Center 1.3, 1.5, and 2.0\]

# Minimize Entity Expansion Threshold for GlideXMLUtil Scriptable \[Updated in Security
Center 1.3, 1.5, and 2.0\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.xmlutil.max_entity_expansion property to change the
maximum entity expansion limit to a smaller number.
This property controls the maximum amount of entity expansion within an XML Parser. If
glide.xmlutil.max_entity_expansion is not set to the recommended
value of 3000 or less, then the GlideXMLUtil parsing scriptable may be vulnerable to
denial of service attacks.

Ensure the property glide.xmlutil.max_entity_expansion is set to
3000 or less. If the instance is on Washington or later, the default implied value is
3000 if the sys_properties record does not exist. If the instance is not on Washington
or later, the recommendaiton is for the instance admin to create a sys_properties record
with name glide.xmlutil.max_entity_expansion and the value
3000.  
Hinweis:  
500 is the default minimum imposed by the ServiceNow AI Platform, which is considered to be a safe threshold.

## More information {#sc-setting-entity-expansion-threshold__section_more_information}

{#sc-setting-entity-expansion-threshold__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.xmlutil.max_entity_expansion |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Purpose | This remediation control must be enabled to defend against XML Entity Expansion/Billion Laugh attack. |
| Recommended value | 3000 |
| Default value | 100000 |
| Security risk rating | 5.3 |
| Functional impact | If the customization is using large entity expansion, then, the ServiceNow AI Platform might block further processing. |
| Security risk | (Moderate) An attacker can use this vulnerability to expand data exponentially, quickly consuming all system resources. |
[ ]

{#sc-setting-entity-expansion-threshold__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).