Every CVESearch/Get API key

CVE-2012-2921

feedparser denial of service vulnerability

5.0 MediumFix available

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Exploit likelihood

2.74%Up 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used5.0

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
CVE-2012-2921
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-399
Updated
2026-11-02
CVE ListNo score

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
CVE-2012-2921
Updated
2026-11-02
EUVDEUVD-2012-0008No score

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
EUVD-2012-0008
Updated
2026-11-03
GitHub AdvisoriesGHSA-hjf3-r7gw-9rwg8.7

feedparser denial of service vulnerability

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
GHSA-hjf3-r7gw-9rwg
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-611
Updated
2026-11-02
OSVGHSA-hjf3-r7gw-9rwg8.7

feedparser denial of service vulnerability

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
GHSA-hjf3-r7gw-9rwg
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-611
Updated
2026-11-02
OSVNo score

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
CVE-2012-2921
Updated
2026-11-02
OSVDEBIAN-CVE-2012-2921No score

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
DEBIAN-CVE-2012-2921
Updated
2026-11-02
OSVPYSEC-2012-14No score

Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.

Record
PYSEC-2012-14
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
feedparser
PyPI
before 5.1.2
5.1.2
feedparser
Debian:12
before 5.1.2-1
5.1.2-1
feedparser
Debian:13
before 5.1.2-1
5.1.2-1
feedparser
Debian:14
before 5.1.2-1
5.1.2-1
feedparser
PyPI
before 5.1.2, plus listed versions
4.15.05.0.15.15.1.1
5.1.2

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2012-2921 is a medium vulnerability (CVSS 5.0) in Mark Pilgrim Feedparser, published May 21, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.74%, the 86th percentile. Fixed in feedparser 5.1.2.

References

Show 9 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open