BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier 7.0 SP6 and earlier and WebLogic Server 6.1 SP7 and earlier allow remote attackers to cause a denial of service (memory exhaustion) via crafted non-canonicalized XML documents.