Red Hat Security Advisory

RHSA-2025:21776

expat security update

Released 2025-11-19 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-1.el8_10, expat-devel-2.5.0-1.el8_10

Fixes 4 records

TI-2013-00270 CVE-2013-0340 · GHSA-w3v2-46wf-pq33

XML external entity injection in libexpat

MEDIUM 54

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource cons…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.19433 Published 2014-01-21 Partial fix · 2.4.0 CWE-611

TI-2022-07953 CVE-2022-23990 · GHSA-r3g2-gw56-v728

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

MEDIUM 46

Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04688 Published 2022-01-26 Partial fix CWE-190

TI-2024-18991 CVE-2024-28757 · GHSA-ch5v-h69f-mxc8

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use…

LOW 37

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02006 Published 2024-03-10 Fixed CWE-776

TI-2025-36934 CVE-2025-59375 · GHSA-vjqp-pjp6-xcxx

Resource allocation without limits in libexpat

LOW 36

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0138 Published 2025-09-15 Partial fix · 2.7.2 CWE-770