Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
expat: Infinite Loop and Data Overflow Risks in XML Parsing
published 6 months ago
Summary
The expat library, used for parsing XML, has been updated to prevent infinite loops and data overflows that could allow an attacker to cause the program to crash or consume excessive resources. This update is important because it prevents potential security risks, and we recommend updating to the latest version of expat to ensure your system remains secure.
What to do
- Update redhat expat to version 2.1.0-15.0.7.el7_9.tuxcare.els1.
- Update redhat expat-devel to version 2.1.0-15.0.7.el7_9.tuxcare.els1.
- Update redhat expat-static to version 2.1.0-15.0.7.el7_9.tuxcare.els1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:RHEL:7 | redhat | expat |
< 2.1.0-15.0.7.el7_9.tuxcare.els1 Fix: upgrade to 2.1.0-15.0.7.el7_9.tuxcare.els1
|
| TuxCare:RHEL:7 | redhat | expat-devel |
< 2.1.0-15.0.7.el7_9.tuxcare.els1 Fix: upgrade to 2.1.0-15.0.7.el7_9.tuxcare.els1
|
| TuxCare:RHEL:7 | redhat | expat-static |
< 2.1.0-15.0.7.el7_9.tuxcare.els1 Fix: upgrade to 2.1.0-15.0.7.el7_9.tuxcare.els1
|
Original advisory text
expat: Fix of 4 CVEs
- CVE-2017-9233: fix external entity infinite loop in entityValueInitProcessor
and entityValueProcessor
- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of
large tokens in small buffer refills; fix buffer growth calculation
- CVE-2013-0340: add billion laughs (entity expansion bomb)
attack protection with amplification limit (100x max, 8 MiB activation
threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
- CVE-2024-28757: add billion laughs (entity expansion bomb)
attack protection with amplification limit (100x max, 8 MiB activation
threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
and entityValueProcessor
- CVE-2023-52425: add reparse deferral heuristic to prevent O(n^2) parsing of
large tokens in small buffer refills; fix buffer growth calculation
- CVE-2013-0340: add billion laughs (entity expansion bomb)
attack protection with amplification limit (100x max, 8 MiB activation
threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
- CVE-2024-28757: add billion laughs (entity expansion bomb)
attack protection with amplification limit (100x max, 8 MiB activation
threshold); includes fix for isolated external parser bypass (CVE-2024-28757)
References
Timeline
Published20 Apr 2026
Updated3 Jun 2026
First seen3 Jun 2026
Sources
CLSA-2026-1776441769 · OSV
Track software like this
Free during beta