libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.