A denial of service issue exists where the billion laughs protection in the `accountingDiffTolerated()` function within `xmlparse.c` detects entity amplification too late. This allows attackers to provide a moderately sized XML document containing a large Document Type Definition (DTD) and nested entity expansions, causing the system to consume significant CPU resources for tens of seconds during parsing.