CVE-2024-28757

Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 10 Mar 2024, 00:00
Last modified:04 Nov 2025, 22:06

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
1.2% LOW
1% probability +0.31%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

10 Mar 2024, 00:00
Published
Vulnerability first disclosed
04 Nov 2025, 22:06
Last Modified
Vulnerability information updated

Description

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 1.20%• Percentile: 79%

Techniques & Countermeasures

  • CWE-776•Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

    The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Affected Systems

  • fedoraproject•fedora

    38 | 39 | 40

  • libexpat_project•libexpat

    < 2.6.2

  • netapp•active_iq_unified_manager

    na

  • netapp•h300s_firmware

    na

  • netapp•h410c_firmware

    na

  • netapp•h410s_firmware

    na

  • netapp•h500s_firmware

    na

  • netapp•h610c_firmware

    na

  • netapp•h610s_firmware

    na

  • netapp•h700s_firmware

    na

  • netapp•oncommand_workflow_automation

    na

  • netapp•ontap

    9

  • netapp•ontap_tools

    10

  • netapp•windows_host_utilities

    na

References (10)