So here are the CVE's for the two big ones, libxml2 and expat.
Both are affected by the expansion of internal entities
(which can be used to consume resources) and external entities
(which can cause a denial of service against other services, be
used to port scan, etc.).
A billion laughs attack is a type of denial-of-service attack
which is aimed at parsers of XML documents.