{"id":"CVE-2023-52426","aliases":["ALPINE-CVE-2023-52426","AZL-34208","AZL-34684","BELL-CVE-2023-52426","DEBIAN-CVE-2023-52426","EUVD-2023-57053","GHSA-mp2w-hjcj-f5g9","JLSEC-2025-59","OESA-2024-1379","SUSE-SU-2025:20207-1","SUSE-SU-2025:20311-1","UBUNTU-CVE-2023-52426","openSUSE-SU-2024:13695-1"],"status":"published","title":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile...","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00394,"percentile":0.34096,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-776"],"published":"2024-02-04T00:00:00Z","modified":"2026-10-28T10:40:36Z","fixes":[{"ecosystem":"Alpine:v3.16","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"expat","fixed_in":["2.6.2-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"expat","fixed_in":["2.6.2-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"expat","fixed_in":["2.6.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"expat","fixed_in":["2.6.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"expat","fixed_in":["2.6.0-1"],"sources":["osv"]},{"ecosystem":"Julia","package":"Expat_jll","fixed_in":["2.6.2+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"expat","fixed_in":["2.6.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.16","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0-r0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.9-r0"},{"fixed":"2.6.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.0-1","2.5.0-1+deb12u1","2.5.0-1+deb12u2","2.5.0-1+deb12u3","2.5.0-1+deb12u4","2.5.0-1+deb12u5","2.5.0-2","2.6.0-1","2.6.1-1","2.6.1-2","2.6.2-1","2.6.2-2","2.6.3-1","2.6.3-2","2.6.4-1","2.7.0-1","2.7.1-1","2.7.1-2","2.7.2-1","2.7.3-1","2.7.3-2","2.7.4-1","2.7.5-1","2.8.0-1","2.8.0-2","2.8.1-1","2.8.2-1","2.8.2-1~deb13u1","2.8.3-1","2.8.3-1~deb13u1","2.8.4-1","2.8.4-2","2.8.5-1","2.8.5-2","2.9.0-1","2.9.0-1~deb13u1"]},{"source":"osv","ecosystem":"Debian:13","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libxmltok","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2-4","1.2-4.1","1.2-4.1~exp1","1.2-4.2"]},{"source":"osv","ecosystem":"Julia","package":"Expat_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.6.2+0"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-11.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-11.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-10.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-slfo.1.1_1.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50-3","3.1.4~abc9f50-4","3.1.4~abc9f50-4ubuntu2","3.1.4~abc9f50-4ubuntu2+esm1","3.1.4~abc9f50-4ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14ubuntu1","5.8.0-14ubuntu3","5.8.0-14.1ubuntu2","5.8.0-14.1ubuntu3","5.8.0-14.1ubuntu3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ayttm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.3-3build1","0.6.3-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cableswig","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.1.0+git20150808-1","0.1.0+git20150808-2","0.1.0+git20150808-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm1","3.1.4~abc9f50+dfsg1-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.1-1ubuntu3","4.8.1-1ubuntu4","4.8.2-3.1ubuntu1","4.9.0-3ubuntu2","4.9.0-4ubuntu1","4.9.0-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-4","2.4.7-4build1","2.4.7-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"vtk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.1+dfsg-2","5.10.1+dfsg-2build3","5.10.1+dfsg-2.1build1","5.10.1+dfsg-2.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"coin3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.4~abc9f50+dfsg1-2","3.1.4~abc9f50+dfsg2-1","3.1.4~abc9f50+dfsg3-1","3.1.4~abc9f50+dfsg3-2","3.1.4~abc9f50+dfsg3-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-5build1","0.13+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-5ubuntu1","2.4.7-5ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.8.3-1","0.9.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12.2-dfsg1-4.1ubuntu1","4.13.2-dfsg1-1ubuntu1","4.13.2-dfsg1-4ubuntu1","4.13.2-dfsg1-6","4.13.2-dfsg1-6ubuntu1","4.13.2-dfsg1-8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds1-6","0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build1","2.4.7-6build2","2.4.7-6ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.23.3-2.1build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"insighttoolkit4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.13.3withdata-dfsg1-4.1","4.13.3withdata-dfsg2-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6build3","2.4.7-6.1","2.4.7-6.1build1","2.4.7-6.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.24+dfsg-2","0.24+dfsg-3","0.24+dfsg-3build1","0.24+dfsg-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1"}]}],"versions":["2.5.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-1","0.13+ds2-1build1","0.13+ds2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.3-1","0.9.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.8+dfsg-3","0.11.8+dfsg-3build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.2","2.4.7-6.2build1","2.4.7-6.2build2","2.4.7-6.2build3","2.4.7-6.2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.33.14-11","1.33.14-11.1","1.33.14-12","1.33.14-12build1","1.33.14-12build2","1.33.14-12ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-6.3","2.4.7-6.3build1","2.4.7-7"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-2","0.9.5.1-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-7","1.59.03-9","1.59.03-10","1.59.03-10.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7.1","2.4.7-7.2","2.4.7-7.2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.6-2","0.9.6-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-3","0.11.10+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.60.05-1","1.60.05-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cadaver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.26+dfsg-2","0.28+dfsg-1","0.28+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"matanza","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13+ds2-2","0.13+ds2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tdom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.5.1-3","0.9.6-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wbxml2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.10+dfsg-2","0.11.10+dfsg-2build1","0.11.10+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xmlrpc-c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.59.03-10.1","1.60.05-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"swish-e","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.7-7","2.4.7-7.1","2.4.7-7.1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"expat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"libexpat_project","product":"libexpat"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec nms"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/libexpat/libexpat/pull/777","tags":["x_transferred","Vendor Advisory","fix","web","report"]},{"url":"https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404","tags":["x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://cwe.mitre.org/data/definitions/776.html","tags":["x_transferred","Technical Description","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240307-0005/","tags":["x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784301.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52426","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV"},{"url":"https://security.netapp.com/advisory/ntap-20240307-0005"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB"},{"url":"https://github.com/advisories/GHSA-mp2w-hjcj-f5g9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-52426","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-52426","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-14","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52426.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-52426","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1379","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28757","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520207-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1219559","tags":["report"]},{"url":"https://bugzilla.suse.com/1219561","tags":["report"]},{"url":"https://bugzilla.suse.com/1221289","tags":["report"]},{"url":"https://bugzilla.suse.com/1229930","tags":["report"]},{"url":"https://bugzilla.suse.com/1229931","tags":["report"]},{"url":"https://bugzilla.suse.com/1229932","tags":["report"]},{"url":"https://bugzilla.suse.com/1232579","tags":["report"]},{"url":"https://bugzilla.suse.com/1232601","tags":["report"]},{"url":"https://bugzilla.suse.com/1239618","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0340","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8176","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520311-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-52426","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52426","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-52426","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T00:00:00Z","modified":"2026-10-15T00:16:53.53Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:35:18.16233Z"}],"euvd":[{"id":"EUVD-2023-57053","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T00:00:00Z","modified":"2026-10-15T00:16:53Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T17:27:11.209168Z"}],"ghsa":[{"id":"GHSA-mp2w-hjcj-f5g9","title":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile...","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T21:30:43Z","modified":"2026-10-15T03:33:13Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T15:13:30.561319Z"}],"nvd":[{"id":"CVE-2023-52426","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T20:15:46.12Z","modified":"2026-10-15T01:17:13.283Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-776"],"updated_at":"2026-11-02T14:09:04.527564Z"}],"osv":[{"id":"ALPINE-CVE-2023-52426","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T20:15:46.12Z","modified":"2026-10-26T17:17:58.661686301Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"AZL-34208","title":"CVE-2023-52426 affecting package expat for versions less than 2.6.2-2","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T20:15:46Z","modified":"2026-04-21T04:27:04.204471Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-34684","title":"CVE-2023-52426 affecting package expat for versions less than 2.6.2-1","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T20:15:46Z","modified":"2026-04-21T04:33:16.567358Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"BELL-CVE-2023-52426","status":"published","published":"2024-02-06T05:57:13.368852Z","modified":"2026-01-26T09:36:48.119897Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:18.192656Z"},{"id":"CVE-2023-52426","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T00:00:00Z","modified":"2026-10-28T10:40:36.796421475Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:35.245372Z"},{"id":"DEBIAN-CVE-2023-52426","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T20:15:46.12Z","modified":"2026-10-26T18:02:59.825695285Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.586408Z"},{"id":"JLSEC-2025-59","title":"libexpat through 2.5.0 allows recursive XML Entity Expansion if `XML_DTD` is undefined at compile...","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if `XML_DTD` is undefined at compile time.","status":"published","published":"2025-10-14T15:35:41.198Z","modified":"2026-07-25T18:23:43.356483473Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:47:17.805107Z"},{"id":"OESA-2024-1379","title":"expat security update","description":"expat is a stream-oriented XML parser library written in C. expat excels with files too large to fit RAM, and where performance and flexibility are crucial.\r\n\r\nSecurity Fix(es):\r\n\r\nlibexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.(CVE-2023-52426)\r\n\r\nlibexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).(CVE-2024-28757)","status":"published","published":"2024-04-12T11:06:49Z","modified":"2026-08-18T01:18:20.443626586Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2023-52426","description":"libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.","status":"published","published":"2024-02-04T20:15:00Z","modified":"2026-10-17T12:57:22.837798955Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:23.935133Z"},{"id":"openSUSE-SU-2024:13695-1","title":"expat-2.6.0-1.1 on GA media","description":"These are all security issues fixed in the expat-2.6.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:46:55.460323Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2025:20207-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n* Bug fixes:\n\n  * Restore event pointer behavior from Expat 2.6.4 (that the fix to CVE-2024-8176 changed in 2.7.0);\n    affected API functions are:\n\n    - XML_GetCurrentByteCount\n    - XML_GetCurrentByteIndex\n    - XML_GetCurrentColumnNumber\n    - XML_GetCurrentLineNumber\n    - XML_GetInputContext\n\n  * Other changes:\n       #976 #977  Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n                    with Automake that were missing from 2.7.0 release tarballs\n       #983 #984  Fix printf format specifiers for 32bit Emscripten\n            #992  docs: Promote OpenSSF Best Practices self-certification\n            #978  tests/benchmark: Resolve mistaken double close\n            #986  Address compiler warnings\n       #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n                    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n                    for what these numbers do\n\n        Infrastructure:\n            #982  CI: Start running Perl XML::Parser integration tests\n            #987  CI: Enforce Clang Static Analyzer clean code\n            #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized\n                    for clang-tidy\n            #981  CI: Cover compilation with musl\n       #983 #984  CI: Cover compilation with 32bit Emscripten\n       #976 #977  CI: Protect against fuzzer files missing from future\n                    release archives\n\nVersion update to 2.7.0 (CVE-2024-8176 [bsc#1239618])\n\n* Security fixes:\n  * CVE-2024-8176 -- Fix crash from chaining a large number\n    of entities caused by stack overflow by resolving use of\n    recursion, for all three uses of entities:\n    - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n    - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n    - parameter entities (\"%p1;\")\n\n   Known impact is (reliable and easy) denial of service:\n\n   CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n\n   (Base Score: 7.5, Temporal Score: 7.2)\n\n   Please note that a layer of compression around XML can\n   significantly reduce the minimum attack payload size.\n\n   * Other changes:\n     * Document changes since the previous release\n     * Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n       to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n       for what these numbers do\n\nVersion update to 2.6.4:\n\n  * Security fixes: [bsc#1232601][bsc#1232579]\n    * CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n      from a NULL pointer dereference by disallowing function\n      XML_StopParser to (stop or) suspend an unstarted parser.\n      A new error code XML_ERROR_NOT_STARTED was introduced to\n      properly communicate this situation.  // CWE-476 CWE-754\n  * Other changes:\n    * Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n      to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n      for what these numbers do\n\nUpdate to 2.6.3:\n\n  * Security fixes:\n    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n      len \u003c 0 without noticing and then calling XML_GetBuffer\n      will have XML_ParseBuffer fail to recognize the problem\n      and XML_GetBuffer corrupt memory.\n      With the fix, XML_ParseBuffer now complains with error\n      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n      has been doing since Expat 2.2.1, and now documented.\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n      integer overflow for nDefaultAtts on 32-bit platforms\n      (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n      have an integer overflow for m_groupSize on 32-bit\n      platforms (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n\n  * Other changes:\n\n    - Version info bumped from 10:2:9 (libexpat*.so.1.9.2)\n      to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/\n      for what these numbers do  \n\nUpdate to 2.6.2:\n\n  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n    use of external parsers (bsc#1221289)\n  * Reject direct parameter entity recursion and avoid the related\n    undefined behavior\n\nUpdate to 2.6.1:\n\n  * Expose billion laughs API with XML_DTD defined and XML_GE\n    undefined, regression from 2.6.0\n  * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n  * Security fixes:\n    - CVE-2023-52425 (bsc#1219559)  \n      Fix quadratic runtime issues with big tokens\n      that can cause denial of service, in partial where\n      dealing with compressed XML input.  Applications\n      that parsed a document in one go -- a single call to\n      functions XML_Parse or XML_ParseBuffer -- were not affected.\n      The smaller the chunks/buffers you use for parsing\n      previously, the bigger the problem prior to the fix.\n      Backporters should be careful to no omit parts of\n      pull request #789 and to include earlier pull request #771,\n      in order to not break the fix.\n    - CVE-2023-52426 (bsc#1219561)\n      Fix billion laughs attacks for users\n      compiling *without* XML_DTD defined (which is not common).\n      Users with XML_DTD defined have been protected since\n      Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n  * Bug fixes:\n    - Fix parse-size-dependent \"invalid token\" error for\n      external entities that start with a byte order mark\n    - Fix NULL pointer dereference in setContext via\n      XML_ExternalEntityParserCreate for compilation with\n      XML_DTD undefined\n    - Protect against closing entities out of order\n  * Other changes:\n    - Improve support for arc4random/arc4random_buf\n    - Improve buffer growth in XML_GetBuffer and XML_Parse\n    - xmlwf: Support --help and --version\n    - xmlwf: Support custom buffer size for XML_GetBuffer and read\n    - xmlwf: Improve language and URL clickability in help output\n    - examples: Add new example \"element_declarations.c\"\n    - Be stricter about macro XML_CONTEXT_BYTES at build time\n    - Make inclusion to expat_config.h consistent\n    - Autotools: configure.ac: Support --disable-maintainer-mode\n    - Autotools: Sync CMake templates with CMake 3.26\n    - Autotools: Make installation of shipped man page doc/xmlwf.1\n      independent of docbook2man availability\n    - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n      section \"Cflags.private\" in order to fix compilation\n      against static libexpat using pkg-config on Windows\n    - Autotools|CMake: Require a C99 compiler\n      (a de-facto requirement already since Expat 2.2.2 of 2017)\n    - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n    - Autotools|CMake: Make test suite require a C++11 compiler\n    - CMake: Require CMake \u003e=3.5.0\n    - CMake: Lowercase off_t and size_t to help a bug in Meson\n    - CMake: Sort xmlwf sources alphabetically\n    - CMake|Windows: Fix generation of DLL file version info\n    - CMake: Build tests/benchmark/benchmark.c as well for\n      a build with -DEXPAT_BUILD_TESTS=ON\n    - docs: Document the importance of isFinal + adjust tests\n      accordingly\n    - docs: Improve use of \"NULL\" and \"null\"\n    - docs: Be specific about version of XML (XML 1.0r4)\n      and version of C (C99); (XML 1.0r5 will need a sponsor.)\n    - docs: reference.html: Promote function XML_ParseBuffer more\n    - docs: reference.html: Add HTML anchors to XML_* macros\n    - docs: reference.html: Upgrade to OK.css 1.2.0\n    - docs: Fix typos\n    - docs|CI: Use HTTPS URLs instead of HTTP at various places\n    - Address compiler warnings\n    - Address clang-tidy warnings\n    - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n      to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n      for what these numbers do\n","status":"published","published":"2025-04-29T11:07:45Z","modified":"2026-03-23T04:50:04.767104Z","updated_at":"2026-11-02T15:53:59.381172Z"},{"id":"SUSE-SU-2025:20311-1","title":"Security update for expat","description":"This update for expat fixes the following issues:\n\nVersion update to 2.7.1:\n\n     Bug fixes:\n\n       #980 #989  Restore event pointer behavior from Expat 2.6.4\n                    (that the fix to CVE-2024-8176 changed in 2.7.0);\n                    affected API functions are:\n                    - XML_GetCurrentByteCount\n                    - XML_GetCurrentByteIndex\n                    - XML_GetCurrentColumnNumber\n                    - XML_GetCurrentLineNumber\n                    - XML_GetInputContext\n\n     Other changes:\n\n       #976 #977  Autotools: Integrate files \"fuzz/xml_lpm_fuzzer.{cpp,proto}\"\n                    with Automake that were missing from 2.7.0 release tarballs\n       #983 #984  Fix printf format specifiers for 32bit Emscripten\n            #992  docs: Promote OpenSSF Best Practices self-certification\n            #978  tests/benchmark: Resolve mistaken double close\n            #986  Address compiler warnings\n       #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)\n                    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/\n                    for what these numbers do\n\n        Infrastructure:\n\n            #982  CI: Start running Perl XML::Parser integration tests\n            #987  CI: Enforce Clang Static Analyzer clean code\n            #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized\n                    for clang-tidy\n            #981  CI: Cover compilation with musl\n       #983 #984  CI: Cover compilation with 32bit Emscripten\n       #976 #977  CI: Protect against fuzzer files missing from future\n                    release archives\n\nversion update to 2.7.0 (CVE-2024-8176 [bsc#1239618]):\n\n  * Security fixes:\n\n       #893 #973  CVE-2024-8176 -- Fix crash from chaining a large number\n                    of entities caused by stack overflow by resolving use of\n                    recursion, for all three uses of entities:\n                    - general entities in character data (\"\u003ce\u003e\u0026g1;\u003c/e\u003e\")\n                    - general entities in attribute values (\"\u003ce k1='\u0026g1;'/\u003e\")\n                    - parameter entities (\"%p1;\")\n                    Known impact is (reliable and easy) denial of service:\n                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C\n                    (Base Score: 7.5, Temporal Score: 7.2)\n                    Please note that a layer of compression around XML can\n                    significantly reduce the minimum attack payload size.\n\n   * Other changes:\n       #935 #937  Autotools: Make generated CMake files look for\n                    libexpat.@SO_MAJOR@.dylib on macOS\n            #925  Autotools: Sync CMake templates with CMake 3.29\n  #945 #962 #966  CMake: Drop support for CMake \u003c3.13\n            #942  CMake: Small fuzzing related improvements\n            #921  docs: Add missing documentation of error code\n                    XML_ERROR_NOT_STARTED that was introduced with 2.6.4\n            #941  docs: Document need for C++11 compiler for use from C++\n            #959  tests/benchmark: Fix a (harmless) TOCTTOU\n            #944  Windows: Fix installer target location of file xmlwf.xml\n                    for CMake\n            #953  Windows: Address warning -Wunknown-warning-option\n                    about -Wno-pedantic-ms-format from LLVM MinGW\n            #971  Address Cppcheck warnings\n       #969 #970  Mass-migrate links from http:// to https://\n    #947 #958 ..\n       #974 #975  Document changes since the previous release\n       #974 #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)\n                    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/\n                    for what these numbers do\n\n- no source changes, just adding jira reference: jsc#SLE-21253\n\nVersion update to 2.6.4 \n\n  * Security fixes: [bsc#1232601][bsc#1232579]\n        #915  CVE-2024-50602 -- Fix crash within function XML_ResumeParser\n                from a NULL pointer dereference by disallowing function\n                XML_StopParser to (stop or) suspend an unstarted parser.\n                A new error code XML_ERROR_NOT_STARTED was introduced to\n                properly communicate this situation.  // CWE-476 CWE-754\n  * Other changes:\n        #903  CMake: Add alias target \"expat::expat\"\n        #905  docs: Document use via CMake \u003e=3.18 with FetchContent\n                and SOURCE_SUBDIR and its consequences\n        #902  tests: Reduce use of global parser instance\n        #904  tests: Resolve duplicate handler\n   #317 #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)\n        #914  Fix signedness of format strings\n   #919 #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)\n                to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/\n                for what these numbers do\n\nUpdate to 2.6.3: \n\n  * Security fixes:\n\n    - CVE-2024-45490, bsc#1229930 -- Calling function XML_ParseBuffer with\n      len \u003c 0 without noticing and then calling XML_GetBuffer\n      will have XML_ParseBuffer fail to recognize the problem\n      and XML_GetBuffer corrupt memory.\n      With the fix, XML_ParseBuffer now complains with error\n      XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse\n      has been doing since Expat 2.2.1, and now documented.\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45491, bsc#1229931 -- Internal function dtdCopy can have an\n      integer overflow for nDefaultAtts on 32-bit platforms\n      (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n    - CVE-2024-45492, bsc#1229932 -- Internal function nextScaffoldPart can\n      have an integer overflow for m_groupSize on 32-bit\n      platforms (where UINT_MAX equals SIZE_MAX).\n      Impact is denial of service to potentially artitrary code\n      execution.\n\nUpdate to 2.6.2:\n\n  * CVE-2024-28757 -- Prevent billion laughs attacks with isolated\n    use of external parsers (bsc#1221289)\n  * Reject direct parameter entity recursion and avoid the related\n    undefined behavior\n\nUpdate to 2.6.1:\n\n  * Expose billion laughs API with XML_DTD defined and XML_GE\n    undefined, regression from 2.6.0\n  * Make tests independent of CPU speed, and thus more robust\n\nUpdate to 2.6.0: \n\n  * Security fixes:\n    - CVE-2023-52425 (bsc#1219559)  \n      -- Fix quadratic runtime issues with big tokens\n      that can cause denial of service, in partial where\n      dealing with compressed XML input.  Applications\n      that parsed a document in one go -- a single call to\n      functions XML_Parse or XML_ParseBuffer -- were not affected.\n      The smaller the chunks/buffers you use for parsing\n      previously, the bigger the problem prior to the fix.\n      Backporters should be careful to no omit parts of\n      pull request #789 and to include earlier pull request #771,\n      in order to not break the fix.\n    - CVE-2023-52426 (bsc#1219561)\n      -- Fix billion laughs attacks for users\n      compiling *without* XML_DTD defined (which is not common).\n      Users with XML_DTD defined have been protected since\n      Expat \u003e=2.4.0 (and that was CVE-2013-0340 back then).\n  * Bug fixes:\n    - Fix parse-size-dependent \"invalid token\" error for\n      external entities that start with a byte order mark\n    - Fix NULL pointer dereference in setContext via\n      XML_ExternalEntityParserCreate for compilation with\n      XML_DTD undefined\n    - Protect against closing entities out of order\n  * Other changes:\n    - Improve support for arc4random/arc4random_buf\n    - Improve buffer growth in XML_GetBuffer and XML_Parse\n    - xmlwf: Support --help and --version\n    - xmlwf: Support custom buffer size for XML_GetBuffer and read\n    - xmlwf: Improve language and URL clickability in help output\n    - examples: Add new example \"element_declarations.c\"\n    - Be stricter about macro XML_CONTEXT_BYTES at build time\n    - Make inclusion to expat_config.h consistent\n    - Autotools: configure.ac: Support --disable-maintainer-mode\n    - Autotools: Sync CMake templates with CMake 3.26\n    - Autotools: Make installation of shipped man page doc/xmlwf.1\n      independent of docbook2man availability\n    - Autotools|CMake: Add missing -DXML_STATIC to pkg-config file\n      section \"Cflags.private\" in order to fix compilation\n      against static libexpat using pkg-config on Windows\n    - Autotools|CMake: Require a C99 compiler\n      (a de-facto requirement already since Expat 2.2.2 of 2017)\n    - Autotools|CMake: Fix PACKAGE_BUGREPORT variable\n    - Autotools|CMake: Make test suite require a C++11 compiler\n    - CMake: Require CMake \u003e=3.5.0\n    - CMake: Lowercase off_t and size_t to help a bug in Meson\n    - CMake: Sort xmlwf sources alphabetically\n    - CMake|Windows: Fix generation of DLL file version info\n    - CMake: Build tests/benchmark/benchmark.c as well for\n      a build with -DEXPAT_BUILD_TESTS=ON\n    - docs: Document the importance of isFinal + adjust tests\n      accordingly\n    - docs: Improve use of \"NULL\" and \"null\"\n    - docs: Be specific about version of XML (XML 1.0r4)\n      and version of C (C99); (XML 1.0r5 will need a sponsor.)\n    - docs: reference.html: Promote function XML_ParseBuffer more\n    - docs: reference.html: Add HTML anchors to XML_* macros\n    - docs: reference.html: Upgrade to OK.css 1.2.0\n    - docs: Fix typos\n    - docs|CI: Use HTTPS URLs instead of HTTP at various places\n    - Address compiler warnings\n    - Address clang-tidy warnings\n    - Version info bumped from 9:10:8 (libexpat*.so.1.8.10)\n      to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/\n      for what these numbers do\n","status":"published","published":"2025-05-13T13:37:27Z","modified":"2026-03-23T04:50:06.711026Z","updated_at":"2026-11-02T15:53:59.381172Z"}]}}