Red Hat Security AdvisoryRHSA-2025:22607
expat security update
Released 2025-12-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) expat-2.2.10-1.el8_8
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) expat-2.2.10-1.el8_8
Fixes 4 records
Priority HIGH 72
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01353 · Published 2025-03-14 · Partial fix · 2.7.0, 2.7.1-1.el10_0 +18 CWE-674
Priority MEDIUM 54
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource cons…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.19433 · Published 2014-01-21 · Partial fix · 2.4.0 CWE-611
Priority MEDIUM 46
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04688 · Published 2022-01-26 · Partial fix CWE-190
Priority LOW 36
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0138 · Published 2025-09-15 · Partial fix · 2.7.2 CWE-770
THREATIST.IORead the docs