CVE-2024-28757

Aliases:DEBIAN-CVE-2024-28757RHBA-2024:2518ALPINE-CVE-2024-28757CGA-qq99-7c35-c8prCGA-vwc4-9f37-2f99
Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 10 Mar 2024, 00:00
Last modified:04 Nov 2025, 22:06

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
2.01% LOW
2% probability +1.12%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

10 Mar 2024, 00:00
Published
Vulnerability first disclosed
04 Nov 2025, 22:06
Last Modified
Vulnerability information updated

Description

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 2.01%• Percentile: 80%

Techniques & Countermeasures

  • CWE-776•Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

    The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Affected Systems

  • alpine•expat

    < 2.6.2-r0 | < 2.6.2-r0 | < 2.6.2-r0 | < 2.6.2-r0 | < 2.6.2-r0 | < 2.6.2-r0 | < 2.6.2-r0 | < 2.6.2-r0 | < 2.6.2-r0

  • chainguard•expat

    < 2.6.2-r0

  • wolfi•expat

    < 2.6.2-r0

  • debian•expat

    all | all | < 2.6.1-2 | < 2.6.1-2

  • debian•libxmltok

    all | all

  • fedoraproject•fedora

    38 | 39 | 40

  • libexpat_project•libexpat

    < 2.6.2

  • netapp•active_iq_unified_manager

    na

  • netapp•h300s_firmware

    na

  • netapp•h410c_firmware

    na

  • netapp•h410s_firmware

    na

  • netapp•h500s_firmware

    na

  • netapp•h610c_firmware

    na

  • netapp•h610s_firmware

    na

  • netapp•h700s_firmware

    na

  • netapp•oncommand_workflow_automation

    na

  • netapp•ontap

    9

  • netapp•ontap_tools

    10

  • netapp•windows_host_utilities

    na

  • redhat•expat

    < 0:2.5.0-2.el9_4

  • redhat•expat-debuginfo

    < 0:2.5.0-2.el9_4 | < 0:2.5.0-2.el9_4

  • redhat•expat-debugsource

    < 0:2.5.0-2.el9_4 | < 0:2.5.0-2.el9_4

  • redhat•expat-devel

    < 0:2.5.0-2.el9_4

References (20)