Is lxml vulnerable to XML bombs?
This has nothing to do with lxml itself, only with the parser of libxml2. Since libxml2 version 2.7, the parser imposes hard security limits on input documents to prevent DoS attacks with forged input data. Since lxml 2.2.1, you can disable these limits with the huge_tree parser option if you need to parse really large, trusted documents. All lxml versions will leave these restrictions enabled by default. Note that libxml2 versions of the 2.6 series do not restrict their parser and are therefore vulnerable to DoS attacks.
