One example of a bug that often festered in XML parsers: https://en.wikipedia.org/wiki/Billion_laughs (there is no JSON equivalent of this)
The generalized theory, for those interested : https://en.wikipedia.org/wiki/Rule_of_least_power