Libexpat Project vulnerabilities, page 3
65 vulnerabilities
Known vulnerabilities in Libexpat Project products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
CVE-2026-76957alpineexpat+18
EPSS score0.11%
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.CVE-2026-76956alpineexpat+17EPSS score0.29%
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.CVE-2026-25210alpineexpat+20EPSS score0.21%
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.CVE-2026-56411alpineexpat+26EPSS score0.13%
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.CVE-2026-56409alpineexpat+26EPSS score0.12%
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.CVE-2026-56410alpineexpat+26EPSS score0.13%
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.CVE-2026-56405alpineexpat+26EPSS score0.13%
libexpat before 2.8.2 has an integer overflow in getAttributeId.CVE-2026-56131alpineexpat+26EPSS score0.18%
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).CVE-2026-56408alpineexpat+26EPSS score0.13%
libexpat before 2.8.2 has an integer overflow in copyString.CVE-2026-56407alpineexpat+26EPSS score0.17%
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.CVE-2026-56412alpineexpat+26EPSS score0.18%
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.CVE-2026-56404alpineexpat+26EPSS score0.13%
libexpat before 2.8.2 has an integer overflow in addBinding.CVE-2026-56403alpineexpat+26EPSS score0.17%
libexpat before 2.8.2 has an integer overflow in storeAtts.CVE-2026-56132alpineexpat+25EPSS score0.10%
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.CVE-2026-56406alpineexpat+26EPSS score0.17%
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.CVE-2026-66046alpineexpat+17EPSS score0.74%
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.CVE-2026-24515alpineexpat+20EPSS score0.19%
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.CVE-2026-45186alpineexpat+26EPSS score0.48%
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.CVE-2026-32778alpineexpat+20EPSS score0.17%
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.CVE-2026-32777alpineexpat+20EPSS score0.22%
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.