{"id":"CVE-2013-0340","aliases":["ALSA-2025:21776","BELL-CVE-2013-0340","CLSA-2026-1767798754","CLSA-2026-1767799061","CLSA-2026-1767799681","CLSA-2026-1776440644","CLSA-2026-1776441540","CLSA-2026-1776441769","DEBIAN-CVE-2013-0340","EUVD-2013-0352","GHSA-w3v2-46wf-pq33","OESA-2021-1261","PSF-2014-1","RHBA-2022:8290","RHSA-2025:21776","RHSA-2025:22035","RHSA-2025:22607","RHSA-2025:22785","RHSA-2025:22842","RHSA-2025:22871","SUSE-SU-2025:20207-1","SUSE-SU-2025:20311-1","openSUSE-SU-2024:10748-1","openSUSE-SU-2024:11285-1"],"status":"published","title":"expat 2.1.0 and earlier does not properly handle entities expansion unless an application...","description":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.19433,"percentile":0.97383,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2014-01-21T18:00:00Z","modified":"2026-10-29T11:12:11Z","fixes":[{"ecosystem":"Debian:12","package":"expat","fixed_in":["2.4.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.4.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.4.1-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","fixed_in":["2.2.9-3.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","fixed_in":["0:2.4.9-1.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","fixed_in":["0:2.4.9-1.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","fixed_in":["0:2.4.9-1.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","fixed_in":["0:2.4.9-1.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","fixed_in":["0:2.4.9-1.el9_1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","fixed_in":["0:2.4.9-1.el9_1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS-Stream:8","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.el8.tuxcare.els1"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"expat-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-15.0.7.el7_9.tuxcare.els1"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-3.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.9-1.el9_1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"expat-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.5.0-1.el8_10"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.0::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-12.el9_0.4"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_4"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.6::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.6::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_6"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::baseos","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.2.10-1.el8_2"}]}],"bundled":18},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-1.2"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python38","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.12-1.2"}]}],"bundled":18}],"products":[{"vendor":"apple","product":"ipados"},{"vendor":"apple","product":"iphone_os"},{"vendor":"apple","product":"macos"},{"vendor":"apple","product":"tvos"},{"vendor":"apple","product":"watchos"},{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"python","product":"python"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"http://openwall.com/lists/oss-security/2013/02/22/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","Mailing List","Third Party Advisory","advisory","article","evidence"]},{"url":"http://www.openwall.com/lists/oss-security/2013/04/12/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.osvdb.org/90634","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link","web"]},{"url":"http://securitytracker.com/id?1028213","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201701-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/58233","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://support.apple.com/kb/HT212805","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT212804","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT212807","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT212819","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT212814","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/kb/HT212815","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/33","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/34","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/40","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/35","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/38","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Sep/39","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2021/10/07/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/62","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/63","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://seclists.org/fulldisclosure/2021/Oct/61","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://github.com/libexpat/libexpat/blob/R_2_4_1/expat/Changes"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-0340","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d@%3Cannounce.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702@%3Cusers.openoffice.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-w3v2-46wf-pq33"},{"url":"https://access.redhat.com/errata/RHSA-2025:21776","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59375","tags":["report"]},{"url":"https://bugzilla.redhat.com/2395108","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2025-21776.html","tags":["advisory"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2013-0340.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2022-23990.html","tags":["report"]},{"url":"https://www.redhat.com/security/data/cve/CVE-2024-28757.html","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2013-0340","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos-stream8els/CLSA-2026-1767798754.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.4els/CLSA-2026-1767799061.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos8.5els/CLSA-2026-1767799681.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1776440644.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1776441540.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1776441769.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-0340","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1261","tags":["advisory"]},{"url":"https://bugs.python.org/issue44394","tags":["report"]},{"url":"https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2022:8290","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2067201","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhba-2022_8290.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-0340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1000109","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-0340","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2395108","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_21776.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-23990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048356","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23990","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23990","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-28757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2268766","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28757","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28757","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/839","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59375","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59375","tags":["advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375","tags":["article"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22035","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2262877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2310137","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22035.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52425","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52425","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52425","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-8176","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-8176","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8176","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/893","tags":["article"]},{"url":"https://github.com/libexpat/libexpat/pull/973","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22607","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22607.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22785","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044484","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056350","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2056354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2140059","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22785.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-45960","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-45960","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-45960","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/531","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-46143","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-46143","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-46143","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/532","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22822","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22822","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22822","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/pull/539","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22823","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22823","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22823","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22824","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22824","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22824","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22825","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22825","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22825","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22826","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22826","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22826","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-22827","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-22827","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-22827","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25313","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25313","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25313","tags":["advisory"]},{"url":"https://blog.hartwork.org/posts/expat-2-4-5-released/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-25314","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-25314","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-25314","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-43680","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43680","tags":["advisory"]},{"url":"https://github.com/libexpat/libexpat/issues/649","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22842","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22842.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22871","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752592","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22871.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20843","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20843","tags":["advisory"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=931031","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-15903","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-15903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-15903","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520207-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219559","tags":["report"]},{"url":"https://bugzilla.suse.com/1219561","tags":["report"]},{"url":"https://bugzilla.suse.com/1221289","tags":["report"]},{"url":"https://bugzilla.suse.com/1229930","tags":["report"]},{"url":"https://bugzilla.suse.com/1229931","tags":["report"]},{"url":"https://bugzilla.suse.com/1229932","tags":["report"]},{"url":"https://bugzilla.suse.com/1232579","tags":["report"]},{"url":"https://bugzilla.suse.com/1232601","tags":["report"]},{"url":"https://bugzilla.suse.com/1239618","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520311-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-3389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-1150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-2667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5010","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-26116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23336","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3426","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-0340","description":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","status":"published","published":"2014-01-21T18:00:00Z","modified":"2026-10-14T06:25:17.335Z","updated_at":"2026-11-02T14:34:59.551717Z"}],"euvd":[{"id":"EUVD-2013-0352","description":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","status":"published","published":"2014-01-21T18:00:00Z","modified":"2026-10-14T06:25:17Z","updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-w3v2-46wf-pq33","title":"expat 2.1.0 and earlier does not properly handle entities expansion unless an application...","description":"expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","status":"published","published":"2022-05-05T02:48:51Z","modified":"2026-10-14T09:32:18Z","cwes":["CWE-611"],"updated_at":"2026-11-02T15:13:23.530725Z"}],"nvd":[{"id":"CVE-2013-0340","description":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","status":"published","published":"2014-01-21T18:55:09.117Z","modified":"2026-10-14T07:16:35.81Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:02:48.062712Z"}],"osv":[{"id":"BELL-CVE-2013-0340","title":"CVE-2013-0340 does not affect BellSoft software","status":"withdrawn","published":"2014-01-21T18:55:00Z","modified":"2026-01-28T07:19:55.932961Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"RHSA-2025:21776","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-11-20T11:01:06Z","modified":"2026-10-15T10:10:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22035","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-11-25T10:06:07Z","modified":"2026-10-15T10:10:52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22607","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-03T10:05:38Z","modified":"2026-10-15T10:10:53Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22785","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-05T10:08:28Z","modified":"2026-10-15T10:10:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22842","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-09T10:06:05Z","modified":"2026-10-15T10:10:54Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"RHSA-2025:22871","title":"Red Hat Security Advisory: expat security update","status":"published","published":"2025-12-09T10:06:09Z","modified":"2026-10-15T10:10:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"ALSA-2025:21776","title":"Important: expat security update","description":"Expat is a C library for parsing XML documents.  \n\nSecurity Fix(es):  \n\n  * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2025-11-19T00:00:00Z","modified":"2026-10-29T11:12:04.817616633Z","updated_at":"2026-11-02T15:27:53.448565Z"},{"id":"CLSA-2026-1767798754","title":"expat: Fix of 3 CVEs","description":"- Rebase to version 2.5.0\n- CVE-2024-28757: prevent billion laughs attacks in isolated external parser\n  (part of #839), reject direct parameter entity recursion (part of #839)\n- CVE-2025-59375: fix memory amplification and add allocation tracker\n- CVE-2013-0340: properly handle entities expansion","status":"published","published":"2026-01-07T15:12:38Z","modified":"2026-10-21T10:47:10.47674306Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1767799061","title":"expat: Fix of 3 CVEs","description":"- Rebase to version 2.5.0\n- CVE-2024-28757: prevent billion laughs attacks in isolated external parser\n  (part of #839), reject direct parameter entity recursion (part of #839)\n- CVE-2025-59375: fix memory amplification and add allocation tracker\n- CVE-2013-0340: properly handle entities expansion","status":"published","published":"2026-01-07T15:17:44Z","modified":"2026-10-21T10:48:06.109784822Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1767799681","title":"expat: Fix of 3 CVEs","description":"- Rebase to version 2.5.0\n- CVE-2024-28757: prevent billion laughs attacks in isolated external parser\n  (part of #839), reject direct parameter entity recursion (part of #839)\n- CVE-2025-59375: fix memory amplification and add allocation tracker\n- CVE-2013-0340: properly handle entities expansion","status":"published","published":"2026-01-07T15:28:05Z","modified":"2026-10-21T10:48:24.020279236Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1776440644","title":"expat: Fix of 4 CVEs","description":"- CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor\n  and entityValueProcessor\n- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of\n  large tokens in small buffer refills; fix buffer growth calculation\n- CVE-2013-0340: add billion laughs (entity expansion bomb)\n  attack protection with amplification limit (100x max, 8 MiB activation\n  threshold); includes fix for isolated external parser bypass (CVE-2024-28757)\n- CVE-2024-28757: add billion laughs (entity expansion bomb)\n  attack protection with amplification limit (100x max, 8 MiB activation\n  threshold); includes fix for isolated external parser bypass (CVE-2024-28757)","status":"published","published":"2026-04-21T17:07:46Z","modified":"2026-10-21T10:45:19.53238604Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776441540","title":"expat: Fix of 4 CVEs","description":"- CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor\n  and entityValueProcessor\n- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of\n  large tokens in small buffer refills; fix buffer growth calculation\n- CVE-2013-0340: add billion laughs (entity expansion bomb)\n  attack protection with amplification limit (100x max, 8 MiB activation\n  threshold); includes fix for isolated external parser bypass (CVE-2024-28757)\n- CVE-2024-28757: add billion laughs (entity expansion bomb)\n  attack protection with amplification limit (100x max, 8 MiB activation\n  threshold); includes fix for isolated external parser bypass (CVE-2024-28757)","status":"published","published":"2026-04-20T08:47:49Z","modified":"2026-10-21T10:48:02.488236575Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1776441769","title":"expat: Fix of 4 CVEs","description":"- CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor\n  and entityValueProcessor\n- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of\n  large tokens in small buffer refills; fix buffer growth calculation\n- CVE-2013-0340: add billion laughs (entity expansion bomb)\n  attack protection with amplification limit (100x max, 8 MiB activation\n  threshold); includes fix for isolated external parser bypass (CVE-2024-28757)\n- CVE-2024-28757: add billion laughs (entity expansion bomb)\n  attack protection with amplification limit (100x max, 8 MiB activation\n  threshold); includes fix for isolated external parser bypass (CVE-2024-28757)","status":"published","published":"2026-04-20T09:17:20Z","modified":"2026-10-21T10:48:14.29219416Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CVE-2013-0340","description":"expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","status":"published","published":"2014-01-21T18:55:09Z","modified":"2026-10-29T11:12:11.3451559Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-0340","description":"expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","status":"published","published":"2014-01-21T18:55:09.117Z","modified":"2026-10-14T11:47:30.48038042Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"OESA-2021-1261","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\r\n\r\nexpat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.(CVE-2013-0340)","status":"published","published":"2021-07-10T11:04:30Z","modified":"2026-08-18T01:15:27.298210302Z","updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"openSUSE-SU-2024:10748-1","title":"expat-2.4.1-1.2 on GA media","description":"These are all security issues fixed in the expat-2.4.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:02:03.620588Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"openSUSE-SU-2024:11285-1","title":"python38-3.8.12-1.2 on GA media","description":"These are all security issues fixed in the python38-3.8.12-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:33:05.866696Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"PSF-2014-1","title":"CVE-2013-0340 Billion Laughs fixed in Expat 2.4.0","description":"expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","status":"published","published":"2014-01-21T18:00:00Z","modified":"2025-10-09T00:59:24.557172Z","updated_at":"2026-11-02T15:52:50.263679Z"},{"id":"RHBA-2022:8290","title":"Red Hat Bug Fix Advisory: expat bug fix and enhancement update","status":"published","published":"2025-12-03T10:01:15Z","modified":"2026-06-26T12:22:46.262747415Z","updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"SUSE-SU-2025:20207-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n* Bug fixes:\n\n  * Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0);\n    affected API functions are:\n\n    - XML_GetCurrentByteCount\n    - XML_GetCurrentByteIndex\n    - XML_GetCurrentColumnNumber\n    - XML_GetCurrentLineNumber\n    - XML_GetInputContext\n\n  * Other changes:\n       #976 #977  Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n                    with Automake that were missing from 2.7.0 release tarballs\n       #983 #984  Fix printf format specifiers for 32bit Emscripten\n            #992  docs: Promote OpenSSF Best Practices self-certification\n            #978  tests/benchmark: Resolve mistaken double close\n            #986  Address compiler warnings\n       #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n                    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n                    for what these numbers do\n\n        Infrastructure:\n            #982  CI: Start running Perl XML::Parser integration tests\n            #987  CI: Enforce Clang Static Analyzer clean code\n            #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized\n                    for clang-tidy\n            #981  CI: Cover compilation with musl\n       #983 #984  CI: Cover compilation with 32bit Emscripten\n       #976 #977  CI: Protect against fuzzer files missing from future\n                    release archives\n\nVersion update to 2.7.0 (CVE-2024-8176 [bsc#1239618])\n\n* Security fixes:\n  * CVE-2024-8176 -- Fix crash from chaining a large number\n    of entities caused by stack overflow by resolving use of\n    recursion, for all three uses of entities:\n    - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n    - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n    - parameter entities (\"%p1;\")\n\n   Known impact is (reliable and easy) denial of service:\n\n   CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n\n   (Base Score: 7.5, Temporal Score: 7.2)\n\n   Please note that a layer of compression around XML can\n   significantly reduce the minimum attack payload size.\n\n   * Other changes:\n     * Document changes since the previous release\n     * Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n       to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n       for what these numbers do\n\nVersion update to 2.6.4:\n\n  * Security fixes: [bsc#1232601][bsc#1232579]\n    * CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n      from a NULL pointer dereference by disallowing function\n      XML_StopParser to (stop or) suspend an unstarted parser.\n      A new error code XML_ERROR_NOT_STARTED was introduced to\n      properly communicate this situation.  // CWE-476 CWE-754\n  * Other changes:\n    * Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n      to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n      for what these numbers do\n\nUpdate to 2.6.3:\n\n  * Security fixes:\n    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n      len \u003c 0 without noticing and then calling XML_GetBuffer\n      will have XML_ParseBuffer fail to recognize the problem\n      and XML_GetBuffer corrupt memory.\n      With the fix, XML_ParseBuffer now complains with error\n      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n      has been doing since Expat 2.2.1, and now documented.\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n      integer overflow for nDefaultAtts on 32-bit platforms\n      (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n      have an integer overflow for m_groupSize on 32-bit\n      platforms (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n\n  * Other changes:\n\n    - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)\n      to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/\n      for what these numbers do  \n\nUpdate to 2.6.2:\n\n  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n    use of external parsers (bsc#1221289)\n  * Reject direct parameter entity recursion and avoid the related\n    undefined behavior\n\nUpdate to 2.6.1:\n\n  * Expose billion laughs API with XML_DTD defined and XML_GE\n    undefined, regression from 2.6.0\n  * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n  * Security fixes:\n    - CVE-2023-52425 (bsc#1219559)  \n      Fix quadratic runtime issues with big tokens\n      that can cause denial of service, in partial where\n      dealing with compressed XML input.  Applications\n      that parsed a document in one go -- a single call to\n      functions XML_Parse or XML_ParseBuffer -- were not affected.\n      The smaller the chunks/buffers you use for parsing\n      previously, the bigger the problem prior to the fix.\n      Backporters should be careful to no omit parts of\n      pull request #789 and to include earlier pull request #771,\n      in order to not break the fix.\n    - CVE-2023-52426 (bsc#1219561)\n      Fix billion laughs attacks for users\n      compiling *without* XML_DTD defined (which is not common).\n      Users with XML_DTD defined have been protected since\n      Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n  * Bug fixes:\n    - Fix parse-size-dependent \"invalid token\" error for\n      external entities that start with a byte order mark\n    - Fix NULL pointer dereference in setContext via\n      XML_ExternalEntityParserCreate for compilation with\n      XML_DTD undefined\n    - Protect against closing entities out of order\n  * Other changes:\n    - Improve support for arc4random/arc4random_buf\n    - Improve buffer growth in XML_GetBuffer and XML_Parse\n    - xmlwf: Support --help and --version\n    - xmlwf: Support custom buffer size for XML_GetBuffer and read\n    - xmlwf: Improve language and URL clickability in help output\n    - examples: Add new example \"element_declarations.c\"\n    - Be stricter about macro XML_CONTEXT_BYTES at build time\n    - Make inclusion to expat_config.h consistent\n    - Autotools: configure.ac: Support --disable-maintainer-mode\n    - Autotools: Sync CMake templates with CMake 3.26\n    - Autotools: Make installation of shipped man page doc/xmlwf.1\n      independent of docbook2man availability\n    - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n      section \"Cflags.private\" in order to fix compilation\n      against static libexpat using pkg-config on Windows\n    - Autotools|CMake: Require a C99 compiler\n      (a de-facto requirement already since Expat 2.2.2 of 2017)\n    - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n    - Autotools|CMake: Make test suite require a C++11 compiler\n    - CMake: Require CMake \u003e=3.5.0\n    - CMake: Lowercase off_t and size_t to help a bug in Meson\n    - CMake: Sort xmlwf sources alphabetically\n    - CMake|Windows: Fix generation of DLL file version info\n    - CMake: Build tests/benchmark/benchmark.c as well for\n      a build with -DEXPAT_BUILD_TESTS=ON\n    - docs: Document the importance of isFinal + adjust tests\n      accordingly\n    - docs: Improve use of \"NULL\" and \"null\"\n    - docs: Be specific about version of XML (XML 1.0r4)\n      and version of C (C99); (XML 1.0r5 will need a sponsor.)\n    - docs: reference.html: Promote function XML_ParseBuffer more\n    - docs: reference.html: Add HTML anchors to XML_* macros\n    - docs: reference.html: Upgrade to OK.css 1.2.0\n    - docs: Fix typos\n    - docs|CI: Use HTTPS URLs instead of HTTP at various places\n    - Address compiler warnings\n    - Address clang-tidy warnings\n    - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n      to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n      for what these numbers do\n","status":"published","published":"2025-04-29T11:07:45Z","modified":"2026-03-23T04:50:04.767104Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20311-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n     Bug fixes:\n\n       #980 #989  Restore event pointer behavior from Expat 2.6.4\n                    (that the fix to CVE-2024-8176 changed in 2.7.0);\n                    affected API functions are:\n                    - XML_GetCurrentByteCount\n                    - XML_GetCurrentByteIndex\n                    - XML_GetCurrentColumnNumber\n                    - XML_GetCurrentLineNumber\n                    - XML_GetInputContext\n\n     Other changes:\n\n       #976 #977  Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n                    with Automake that were missing from 2.7.0 release tarballs\n       #983 #984  Fix printf format specifiers for 32bit Emscripten\n            #992  docs: Promote OpenSSF Best Practices self-certification\n            #978  tests/benchmark: Resolve mistaken double close\n            #986  Address compiler warnings\n       #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n                    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n                    for what these numbers do\n\n        Infrastructure:\n\n            #982  CI: Start running Perl XML::Parser integration tests\n            #987  CI: Enforce Clang Static Analyzer clean code\n            #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized\n                    for clang-tidy\n            #981  CI: Cover compilation with musl\n       #983 #984  CI: Cover compilation with 32bit Emscripten\n       #976 #977  CI: Protect against fuzzer files missing from future\n                    release archives\n\nversion update to 2.7.0 (CVE-2024-8176 [bsc#1239618]):\n\n  * Security fixes:\n\n       #893 #973  CVE-2024-8176 -- Fix crash from chaining a large number\n                    of entities caused by stack overflow by resolving use of\n                    recursion, for all three uses of entities:\n                    - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n                    - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n                    - parameter entities (\"%p1;\")\n                    Known impact is (reliable and easy) denial of service:\n                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n                    (Base Score: 7.5, Temporal Score: 7.2)\n                    Please note that a layer of compression around XML can\n                    significantly reduce the minimum attack payload size.\n\n   * Other changes:\n       #935 #937  Autotools: Make generated CMake files look for\n                    libexpat.@SO_MAJOR@.dylib on macOS\n            #925  Autotools: Sync CMake templates with CMake 3.29\n  #945 #962 #966  CMake: Drop support for CMake \u003c3.13\n            #942  CMake: Small fuzzing related improvements\n            #921  docs: Add missing documentation of error code\n                    XML_ERROR_NOT_STARTED that was introduced with 2.6.4\n            #941  docs: Document need for C++11 compiler for use from C++\n            #959  tests/benchmark: Fix a (harmless) TOCTTOU\n            #944  Windows: Fix installer target location of file xmlwf.xml\n                    for CMake\n            #953  Windows: Address warning -Wunknown-warning-option\n                    about -Wno-pedantic-ms-format from LLVM MinGW\n            #971  Address Cppcheck warnings\n       #969 #970  Mass-migrate links from http:// to https://\n    #947 #958 ..\n       #974 #975  Document changes since the previous release\n       #974 #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n                    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n                    for what these numbers do\n\n- no source changes, just adding jira reference: jsc#SLE-21253\n\nVersion update to 2.6.4 \n\n  * Security fixes: [bsc#1232601][bsc#1232579]\n        #915  CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n                from a NULL pointer dereference by disallowing function\n                XML_StopParser to (stop or) suspend an unstarted parser.\n                A new error code XML_ERROR_NOT_STARTED was introduced to\n                properly communicate this situation.  // CWE-476 CWE-754\n  * Other changes:\n        #903  CMake: Add alias target \"expat::expat\"\n        #905  docs: Document use via CMake \u003e=3.18 with FetchContent\n                and SOURCE_SUBDIR and its consequences\n        #902  tests: Reduce use of global parser instance\n        #904  tests: Resolve duplicate handler\n   #317 #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)\n        #914  Fix signedness of format strings\n   #919 #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n                to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n                for what these numbers do\n\nUpdate to 2.6.3: \n\n  * Security fixes:\n\n    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n      len \u003c 0 without noticing and then calling XML_GetBuffer\n      will have XML_ParseBuffer fail to recognize the problem\n      and XML_GetBuffer corrupt memory.\n      With the fix, XML_ParseBuffer now complains with error\n      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n      has been doing since Expat 2.2.1, and now documented.\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n      integer overflow for nDefaultAtts on 32-bit platforms\n      (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n      have an integer overflow for m_groupSize on 32-bit\n      platforms (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n\nUpdate to 2.6.2:\n\n  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n    use of external parsers (bsc#1221289)\n  * Reject direct parameter entity recursion and avoid the related\n    undefined behavior\n\nUpdate to 2.6.1:\n\n  * Expose billion laughs API with XML_DTD defined and XML_GE\n    undefined, regression from 2.6.0\n  * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n  * Security fixes:\n    - CVE-2023-52425 (bsc#1219559)  \n      -- Fix quadratic runtime issues with big tokens\n      that can cause denial of service, in partial where\n      dealing with compressed XML input.  Applications\n      that parsed a document in one go -- a single call to\n      functions XML_Parse or XML_ParseBuffer -- were not affected.\n      The smaller the chunks/buffers you use for parsing\n      previously, the bigger the problem prior to the fix.\n      Backporters should be careful to no omit parts of\n      pull request #789 and to include earlier pull request #771,\n      in order to not break the fix.\n    - CVE-2023-52426 (bsc#1219561)\n      -- Fix billion laughs attacks for users\n      compiling *without* XML_DTD defined (which is not common).\n      Users with XML_DTD defined have been protected since\n      Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n  * Bug fixes:\n    - Fix parse-size-dependent \"invalid token\" error for\n      external entities that start with a byte order mark\n    - Fix NULL pointer dereference in setContext via\n      XML_ExternalEntityParserCreate for compilation with\n      XML_DTD undefined\n    - Protect against closing entities out of order\n  * Other changes:\n    - Improve support for arc4random/arc4random_buf\n    - Improve buffer growth in XML_GetBuffer and XML_Parse\n    - xmlwf: Support --help and --version\n    - xmlwf: Support custom buffer size for XML_GetBuffer and read\n    - xmlwf: Improve language and URL clickability in help output\n    - examples: Add new example \"element_declarations.c\"\n    - Be stricter about macro XML_CONTEXT_BYTES at build time\n    - Make inclusion to expat_config.h consistent\n    - Autotools: configure.ac: Support --disable-maintainer-mode\n    - Autotools: Sync CMake templates with CMake 3.26\n    - Autotools: Make installation of shipped man page doc/xmlwf.1\n      independent of docbook2man availability\n    - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n      section \"Cflags.private\" in order to fix compilation\n      against static libexpat using pkg-config on Windows\n    - Autotools|CMake: Require a C99 compiler\n      (a de-facto requirement already since Expat 2.2.2 of 2017)\n    - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n    - Autotools|CMake: Make test suite require a C++11 compiler\n    - CMake: Require CMake \u003e=3.5.0\n    - CMake: Lowercase off_t and size_t to help a bug in Meson\n    - CMake: Sort xmlwf sources alphabetically\n    - CMake|Windows: Fix generation of DLL file version info\n    - CMake: Build tests/benchmark/benchmark.c as well for\n      a build with -DEXPAT_BUILD_TESTS=ON\n    - docs: Document the importance of isFinal + adjust tests\n      accordingly\n    - docs: Improve use of \"NULL\" and \"null\"\n    - docs: Be specific about version of XML (XML 1.0r4)\n      and version of C (C99); (XML 1.0r5 will need a sponsor.)\n    - docs: reference.html: Promote function XML_ParseBuffer more\n    - docs: reference.html: Add HTML anchors to XML_* macros\n    - docs: reference.html: Upgrade to OK.css 1.2.0\n    - docs: Fix typos\n    - docs|CI: Use HTTPS URLs instead of HTTP at various places\n    - Address compiler warnings\n    - Address clang-tidy warnings\n    - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n      to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n      for what these numbers do\n","status":"published","published":"2025-05-13T13:37:27Z","modified":"2026-03-23T04:50:06.711026Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}