Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
xmlrpc-c packages may cause server slowdown or crash
published 1 year ago
Summary
The xmlrpc-c libraries used on AlmaLinux can be tricked into processing overly large XML data, which can consume too much memory and slow down or stop services. This mainly affects the xmlrpc-c, xmlrpc-c-c++, xmlrpc-c-client, xmlrpc-c-client++, and xmlrpc-c-devel packages. Apply the latest security update from AlmaLinux to fix the problem.
What to do
- Update almalinux xmlrpc-c to version 1.51.0-11.el8_10.
- Update almalinux xmlrpc-c-c++ to version 1.51.0-11.el8_10.
- Update almalinux xmlrpc-c-client to version 1.51.0-11.el8_10.
- Update almalinux xmlrpc-c-client++ to version 1.51.0-11.el8_10.
- Update almalinux xmlrpc-c-devel to version 1.51.0-11.el8_10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:8 | almalinux | xmlrpc-c |
< 1.51.0-11.el8_10 Fix: upgrade to 1.51.0-11.el8_10
|
| AlmaLinux:8 | almalinux | xmlrpc-c-c++ |
< 1.51.0-11.el8_10 Fix: upgrade to 1.51.0-11.el8_10
|
| AlmaLinux:8 | almalinux | xmlrpc-c-client |
< 1.51.0-11.el8_10 Fix: upgrade to 1.51.0-11.el8_10
|
| AlmaLinux:8 | almalinux | xmlrpc-c-client++ |
< 1.51.0-11.el8_10 Fix: upgrade to 1.51.0-11.el8_10
|
| AlmaLinux:8 | almalinux | xmlrpc-c-devel |
< 1.51.0-11.el8_10 Fix: upgrade to 1.51.0-11.el8_10
|
Original advisory text
Moderate: xmlrpc-c security update
XML-RPC is a remote procedure call (RPC) protocol that uses XML to encode its calls and HTTP as a transport mechanism. The xmlrpc-c packages provide a network protocol to allow a client program to make a simple RPC (remote procedure call) over the Internet. It converts an RPC into an XML document, sends it to a remote server using HTTP, and gets back the response in XML.
Security Fix(es):
* libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2025:4048 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2024-8176 Third Party Advisory
- https://bugzilla.redhat.com/2310137 Third Party Advisory
- https://errata.almalinux.org/8/ALSA-2025-4048.html Vendor Advisory
Timeline
Published22 Apr 2025
Updated29 Oct 2026
First seen29 Oct 2026
Sources
ALSA-2025:4048 · OSV
Track software like this
Free during beta