Libexpat Project Libexpat vulnerabilities
65 vulnerabilities
Known vulnerabilities in Libexpat Project Libexpat, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-20843alpineexpat+40
EPSS score7.11%
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).CVE-2013-0340appleipados+12EPSS score19.43%
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.CVE-2021-46143alpineexpat+42EPSS score4.22%
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.CVE-2021-45960alpineexpat+25EPSS score4.35%
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).CVE-2015-1283canonicalubuntu_linux+30EPSS score18.44%
Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.CVE-2016-0718alpineexpat+34EPSS score13.33%
Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.CVE-2016-4472alpineexpat+17EPSS score11.95%
The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.CVE-2016-5300alpineexpat+10EPSS score6.54%
The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.CVE-2025-59375alpineexpat+68EPSS score1.31%
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.CVE-2025-66382debianexpat+18EPSS score0.20%
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.CVE-2022-40674alpineexpat+83EPSS score2.25%
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.CVE-2022-25313alpineexpat+24EPSS score3.29%
In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.CVE-2022-25235alpineexpat+31EPSS score4.96%
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.CVE-2022-25315alpineexpat+24EPSS score4.82%
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.CVE-2022-25236alpineexpat+61EPSS score35.27%
xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.CVE-2022-25314alpineexpat+24EPSS score4.82%
In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.CVE-2022-43680alpineexpat+73EPSS score2.46%
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.CVE-2022-22824alpineexpat+23EPSS score3.60%
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22826alpineexpat+23EPSS score2.96%
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.CVE-2022-22827alpineexpat+23EPSS score2.96%
storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.