Every CVE Search/ Get API key

CVE-2013-1664

XML Entity Expansion (XEE) in Django

5.0 MediumFix available

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Exploit likelihood

4.77%Up 2.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
CVE-2013-1664
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
CVE-2013-1664
Updated
2026-11-02
EUVDEUVD-2022-5025 No score

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
EUVD-2022-5025
Updated
2026-11-03
GitHub AdvisoriesGHSA-qrh7-x6fp-c2mp No score

XML Entity Expansion (XEE) in Django

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
GHSA-qrh7-x6fp-c2mp
Weakness
CWE-611
Updated
2026-11-02
OSV No score

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
CVE-2013-1664
Updated
2026-11-02
OSVDEBIAN-CVE-2013-1664 No score

The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
DEBIAN-CVE-2013-1664
Updated
2026-11-02
OSVGHSA-qrh7-x6fp-c2mp No score

XML Entity Expansion (XEE) in Django

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
GHSA-qrh7-x6fp-c2mp
Weakness
CWE-611
Updated
2026-11-02
OSVPYSEC-2026-801 No score

XML Entity Expansion (XEE) in Django

The XML libraries for Python, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.

Record
PYSEC-2026-801
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django
PyPI
 1.3.0 up to 1.3.6
1.3.6
django
PyPI
 1.4.0 up to 1.4.4
1.4.4
cinder
Debian:12
 before 2012.2.3-1
2012.2.3-1
cinder
Debian:13
 before 2012.2.3-1
2012.2.3-1
cinder
Debian:14
 before 2012.2.3-1
2012.2.3-1
keystone
Debian:12
 before 2012.1.1-13
2012.1.1-13
keystone
Debian:13
 before 2012.1.1-13
2012.1.1-13
keystone
Debian:14
 before 2012.1.1-13
2012.1.1-13
nova
Debian:12
 before 2012.1.1-13
2012.1.1-13
nova
Debian:13
 before 2012.1.1-13
2012.1.1-13
Show 24 moreShow less
Affected packages
PackageAffectedFixed
nova
Debian:14
 before 2012.1.1-13
2012.1.1-13
django
PyPI
 1.3.0 up to 1.3.6, plus listed versions
1.31.3.11.3.21.3.31.3.41.3.5
1.3.6
django
PyPI
 1.4.0 up to 1.4.4, plus listed versions
1.41.4.11.4.21.4.3
1.4.4
django
PyPI
 1.3.0 up to 1.3.6, 1.4.0 up to 1.4.4, plus listed versions
1.31.3.11.3.21.3.31.3.4
Show 5 moreShow less
1.3.51.41.4.11.4.21.4.3
1.3.61.4.4
openstack-keystone
Red Hat:openstack:2::el6
 before 0:2012.2.3-3.el6ost
0:2012.2.3-3.el6ost
openstack-keystone-doc
Red Hat:openstack:2::el6
 before 0:2012.2.3-3.el6ost
0:2012.2.3-3.el6ost
python-keystone
Red Hat:openstack:2::el6
 before 0:2012.2.3-3.el6ost
0:2012.2.3-3.el6ost
openstack-nova
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-api
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-cert
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-common
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-compute
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-console
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-doc
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-network
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-objectstore
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-scheduler
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-nova-volume
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
python-nova
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-cinder
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
openstack-cinder-doc
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
python-cinder
Red Hat:openstack:2::el6
 before 0:2012.2.3-4.el6ost
0:2012.2.3-4.el6ost
Django14
Red Hat:openstack:2::el6
 before 0:1.4.4-1.el6ost
0:1.4.4-1.el6ost
Django14-doc
Red Hat:openstack:2::el6
 before 0:1.4.4-1.el6ost
0:1.4.4-1.el6ost

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-1664 is a medium vulnerability (CVSS 5.0) in Openstack Cinder Folsom, published April 3, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.77%, the 91st percentile. Fixed in django 1.3.6.

References

Show 61 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open