CVE-2012-2921
feedparser denial of service vulnerability
CVE-2012-2921 is a medium vulnerability (CVSS 5.0) in Mark Pilgrim Feedparser, published May 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. Fixed in feedparser 5.1.2.
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
Exploit likelihood
What each source reports
NVD Score used
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
CVE-2012-2921- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
CVE-2012-2921- Updated
- 2026-11-02
EUVDEUVD-2012-0008 No score
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
EUVD-2012-0008- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hjf3-r7gw-9rwg
feedparser denial of service vulnerability
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
GHSA-hjf3-r7gw-9rwg- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVGHSA-hjf3-r7gw-9rwg
feedparser denial of service vulnerability
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
GHSA-hjf3-r7gw-9rwg- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV No score
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
CVE-2012-2921- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-2921 No score
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
DEBIAN-CVE-2012-2921- Updated
- 2026-11-02
OSVPYSEC-2012-14 No score
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.
- Record
PYSEC-2012-14- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
feedparserPyPI |
before 5.1.2 | 5.1.2 |
feedparserDebian:12 |
before 5.1.2-1 | 5.1.2-1 |
feedparserDebian:13 |
before 5.1.2-1 | 5.1.2-1 |
feedparserDebian:14 |
before 5.1.2-1 | 5.1.2-1 |
feedparserPyPI |
before 5.1.2, plus listed versions 4.15.05.0.15.15.1.1 |
5.1.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
osvdb.org/81701
code.google.com/p/feedparser/source/browse/trunk/NEWS?spec=svn706&r=706
wiki.mageia.org/en/Support/Advisories/MGASA-2012-0157
securityfocus.com/bid/53654
mandriva.com/security/advisories?name=MDVSA-2013:118
Show 9 moreShow less
freecode.com/projects/feedparser/releases/344371
secunia.com/advisories/49256
nvd.nist.gov/vuln/detail/CVE-2012-2921
github.com/advisories/GHSA-hjf3-r7gw-9rwg
web.archive.org/web/20120604210617/http://www.securityfocus.com/bid/53654
security-tracker.debian.org/tracker/CVE-2012-2921