parser.c in libxml2 prior to 2.9.5 does not prevent infinite recursion in parameter entities.
xmlsoft libxml2