Libexpat Project Libexpat vulnerabilities

• libexpat libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes CVE-2026-118370 Fix available 8.2 HighOctober 28, 2026
• libexpat libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser CVE-2026-117610 Fix available 8.2 HighOctober 28, 2026
• libexpat libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay CVE-2026-115506 Fix available 8.7 HighOctober 22, 2026
• libexpat libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset CVE-2026-113351 Fix available 8.2 HighOctober 20, 2026
• libexpat project libexpat libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a... CVE-2026-76957 Fix available 4.9 MediumAugust 20, 2026
• libexpat project libexpat In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to... CVE-2026-76956 Fix available 5.9 MediumAugust 20, 2026
• libexpat project libexpat Expat Denial of Service via storeAtts() Quadratic Complexity CVE-2026-66046 Fix available 8.7 HighAugust 18, 2026
• libexpat project libexpat libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks... CVE-2026-56412 Fix available 4.9 MediumJune 21, 2026
• libexpat project libexpat xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. CVE-2026-56411 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. CVE-2026-56410 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir... CVE-2026-56409 Fix available 6.5 MediumJune 21, 2026
• libexpat project libexpat libexpat before 2.8.2 has an integer overflow in copyString. CVE-2026-56408 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and... CVE-2026-56407 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that... CVE-2026-56406 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat libexpat before 2.8.2 has an integer overflow in getAttributeId. CVE-2026-56405 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat libexpat before 2.8.2 has an integer overflow in addBinding. CVE-2026-56404 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat libexpat before 2.8.2 has an integer overflow in storeAtts. CVE-2026-56403 Fix available 6.9 MediumJune 21, 2026
• libexpat project libexpat In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because... CVE-2026-56132 Fix available 6.9 MediumJune 19, 2026
• libexpat project libexpat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within... CVE-2026-56131 Fix available 4.9 MediumJune 19, 2026
• libexpat project libexpat libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse,... CVE-2026-50219 Fix available 4.9 MediumJune 4, 2026
• libexpat project libexpat, red hat discovery 2, enterprise linux 10 +9 more +11 more In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows... CVE-2026-45186 Fix available 2.9 LowMay 10, 2026
• libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more libexpat before 2.7.6 uses insufficient entropy, and thus hash flooding can occur via a crafted... CVE-2026-41080 Fix available 2.9 LowApril 16, 2026
• libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after... CVE-2026-32778 Fix available 2.9 LowMarch 16, 2026
• libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more libexpat before 2.7.5 allows an infinite loop while parsing DTD content. CVE-2026-32777 Fix available 4.0 MediumMarch 16, 2026
• libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 more libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity... CVE-2026-32776 Fix available 4.0 MediumMarch 16, 2026
• libexpat project libexpat, siemens ruggedcom rst2428p +1 more In libexpat before 2.7.4, the doContent function does not properly determine the buffer size... CVE-2026-25210 Fix available 6.9 MediumJanuary 30, 2026
• libexpat project libexpat, siemens ruggedcom rst2428p +1 more In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler... CVE-2026-24515 Fix available 2.9 LowJanuary 23, 2026
• libexpat project libexpat, siemens ruggedcom rst2428p, simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 more In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of... CVE-2025-66382 Fix available 2.9 LowNovember 28, 2025
• libexpat project libexpat, siemens ruggedcom rst2428p, scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family +17 more +19 more libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a... CVE-2025-59375 Fix available 7.5 HighSeptember 15, 2025
• libexpat project libexpat, debian linux, netapp active iq unified manager +26 more +28 more An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser... CVE-2024-50602 Public exploitFix available 5.9 MediumOctober 27, 2024
• libexpat expat, libexpat project libexpat, siemens ruggedcom rst2428p +5 more +7 more An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an... CVE-2024-45492 Fix available 9.8 CriticalAugust 30, 2024
• libexpat expat, libexpat project libexpat, siemens ruggedcom rst2428p +5 more +7 more An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer... CVE-2024-45491 Fix available 9.8 CriticalAugust 30, 2024
• libexpat project libexpat, siemens ruggedcom rst2428p, scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family +4 more +6 more An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length... CVE-2024-45490 Public exploitFix available 7.5 HighAugust 30, 2024
• libexpat project libexpat, fedoraproject fedora, netapp active iq unified manager +15 more +17 more libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of... CVE-2024-28757 Public exploitFix available 7.5 HighMarch 10, 2024
• libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 more libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile... CVE-2023-52426 Fix available 5.5 MediumFebruary 4, 2024
• libexpat project libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 more libexpat through 2.5.0 allows a denial of service (resource consumption) because many full... CVE-2023-52425 Fix available 7.5 HighFebruary 4, 2024
• libexpat project libexpat, debian linux, fedoraproject fedora +12 more +14 more In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared... CVE-2022-43680 Public exploitFix available 7.5 HighOctober 24, 2022
• libexpat project libexpat, debian linux, fedoraproject fedora +3 more +5 more libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. CVE-2022-40674 Fix available 8.1 HighSeptember 14, 2022
• libexpat project libexpat, debian linux, fedoraproject fedora +6 more +8 more In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. CVE-2022-25314 Public exploitFix available 7.5 HighFebruary 18, 2022
• libexpat project libexpat, debian linux, fedoraproject fedora +6 more +8 more In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. CVE-2022-25315 Public exploitFix available 9.8 CriticalFebruary 18, 2022
• libexpat project libexpat, debian linux, fedoraproject fedora +6 more +8 more In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via... CVE-2022-25313 Public exploitFix available 6.5 MediumFebruary 18, 2022
• libexpat project libexpat, debian linux, oracle http server +5 more +7 more xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator... CVE-2022-25236 Public exploitFix available EPSS 35.3% 9.8 CriticalFebruary 15, 2022
• libexpat project libexpat, debian linux, fedoraproject fedora +6 more +8 more xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as... CVE-2022-25235 Public exploitFix available 9.8 CriticalFebruary 15, 2022
• libexpat project libexpat, debian linux, fedoraproject fedora +6 more +8 more Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. CVE-2022-23990 Public exploitFix available 7.5 HighJanuary 26, 2022
• libexpat project libexpat, debian linux, netapp clustered data ontap +7 more +9 more Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for... CVE-2022-23852 Public exploitFix available 9.8 CriticalJanuary 24, 2022
• libexpat project libexpat, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +4 more +6 more addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVE-2022-22822 Public exploitFix available 9.8 CriticalJanuary 8, 2022
• libexpat project libexpat, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +4 more +6 more build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVE-2022-22823 Fix available 9.8 CriticalJanuary 8, 2022
• libexpat project libexpat, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +4 more +6 more defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVE-2022-22824 Fix available 9.8 CriticalJanuary 8, 2022
• libexpat project libexpat, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +4 more +6 more lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVE-2022-22825 Fix available 8.8 HighJanuary 8, 2022
• libexpat project libexpat, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +4 more +6 more nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. CVE-2022-22826 Fix available 8.8 HighJanuary 8, 2022
• Show olderLoading…