The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the…
Priority MEDIUM 44CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Partial Red Hat: 13 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
Why it matters now
EPSS 0.24313 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 3 advisoriesRed Hat: 13 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libexpat_project:libexpat:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | libexpat project |
| cpe:2.3:a:xmltwig:xml-twig_for_perl:*:*:*:*:*:*:*:* | all versions | Running on | Xmltwig |
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | 2.0.35 to before 2.0.64; 2.2.0 to before 2.2.17 | Vulnerable | Apache |
- cpe:2.3:a:libexpat_project:libexpat:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·libexpat project
- cpe:2.3:a:xmltwig:xml-twig_for_perl:*:*:*:*:*:*:*:* Versions all versions Running on ·Xmltwig
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions 2.0.35 to before 2.0.64; 2.2.0 to before 2.2.17 Vulnerable ·Apache
Remediation
Red Hat 3 advisories
- RHSA-2017:3239 Released 2017-11-16 · Red Hat rating ImportantRed Hat JBoss Enterprise Application Platform 6.4.18 security update
- Red Hat JBoss Enterprise Application Platform 6.4
- RHSA-2011:0896 Released 2011-06-22 · Red Hat rating ModerateJBoss Enterprise Web Server 1.0.2 update
- Red Hat JBoss Web Server 1.0
- RHSA-2009:1625 Released 2009-12-07 · Red Hat rating Moderateexpat security update
- Red Hat Desktop version 3 expat-1.95.5-6.2, expat-1.95.5-6.2.i386, expat-devel-1.95.5-6.2 +1
- Red Hat Enterprise Linux (v. 5 server) expat-1.95.8-8.3.el5_4.2, expat-1.95.8-8.3.el5_4.2.i386, expat-1.95.8-8.3.el5_4.2.ia64 +5
- Red Hat Enterprise Linux AS version 3 expat-1.95.5-6.2, expat-1.95.5-6.2.i386, expat-1.95.5-6.2.ia64 +5
- Red Hat Enterprise Linux AS version 4 expat-1.95.7-4.el4_8.2, expat-1.95.7-4.el4_8.2.i386, expat-1.95.7-4.el4_8.2.ia64 +5
- Red Hat Enterprise Linux Desktop (v. 5 client) expat-1.95.8-8.3.el5_4.2, expat-1.95.8-8.3.el5_4.2.i386
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) expat-1.95.8-8.3.el5_4.2, expat-devel-1.95.8-8.3.el5_4.2, expat-devel-1.95.8-8.3.el5_4.2.i386
- Red Hat Enterprise Linux Desktop version 4 expat-1.95.7-4.el4_8.2, expat-1.95.7-4.el4_8.2.i386, expat-devel-1.95.7-4.el4_8.2 +1
- Red Hat Enterprise Linux ES version 3 expat-1.95.5-6.2, expat-1.95.5-6.2.i386, expat-1.95.5-6.2.ia64 +3
- Red Hat Enterprise Linux ES version 4 expat-1.95.7-4.el4_8.2, expat-1.95.7-4.el4_8.2.i386, expat-1.95.7-4.el4_8.2.ia64 +3
- Red Hat Enterprise Linux WS version 3 expat-1.95.5-6.2, expat-1.95.5-6.2.i386, expat-1.95.5-6.2.ia64 +3
- Red Hat Enterprise Linux WS version 4 expat-1.95.7-4.el4_8.2, expat-1.95.7-4.el4_8.2.i386, expat-1.95.7-4.el4_8.2.ia64 +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Desktop version 3 | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2009:1625 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2009:1625 |
| Red Hat JBoss Enterprise Application Platform 6.4 | Fixed | RHSA-2017:3239 |
| Red Hat JBoss Web Server 1.0 | Fixed | RHSA-2011:0896 |
Not affected: 2 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Timeline
- 2026-10-02 Threatist record created from CVE-2009-3560
- 2026-10-03 Alias added: GHSA-pcgv-8c5g-4m8p
References
Exploit 1
Advisory 16
Other 30
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.164&r2=1.165
- [security-announce] 20100303 VMSA-2010-0004 ESX Service Console and vMA third party updates
- ADV-2010-1107
- oval:org.mitre.oval:def:6883
- oval:org.mitre.oval:def:12942
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?view=log#rev1.165
- oval:org.mitre.oval:def:10613
- ADV-2010-0896
- ADV-2011-0359
- ADV-2010-0528
- [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058586 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20200401 svn commit: r1058587 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1888194 [6/13] - /httpd/site/trunk/content/security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073139 [6/13] - in /websites/staging/httpd/trunk/content: ./ security/json/
- [httpd-cvs] 20210330 svn commit: r1073140 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073143 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/
- [httpd-cvs] 20210330 svn commit: r1073149 [7/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210330 svn commit: r1073146 [2/3] - in /websites/staging/httpd/trunk/content: ./ security/cvejsontohtml.py security/vulnerabilities-httpd.xml security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210330 svn commit: r1073149 [1/13] - in /websites/staging/httpd/trunk/content: ./ security/ security/json/
- [httpd-cvs] 20210603 svn commit: r1075360 [1/3] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210606 svn commit: r1075467 [1/2] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2021-31618.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
- [httpd-cvs] 20210606 svn commit: r1075470 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/json/CVE-2020-13938.json security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html
Sources
- CVE-2009-3560 · CVE Program
- CVE-2009-3560 · NVD
- FIRST EPSS
- GHSA-pcgv-8c5g-4m8p · GitHub Advisory Database · CC BY 4.0
- CVE-2009-3560 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences