XML external entity injection in libexpat
Priority MEDIUM 54CWE-611Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Partial Red Hat: 12 fixed, 3 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.19433 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial libexpat: 2.4.0Red Hat: 6 advisoriesRed Hat: 12 fixed, 3 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | libexpat | before 2.4.0 | 2.4.0 | Patch available | CNA |
- libexpat Vendor— Affected before 2.4.0 Fixed in 2.4.0 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* | before 2.4.0 | Vulnerable | libexpat project |
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | 3.6.0 to before 3.6.15; 3.7.0 to before 3.7.12; 3.8.0 to before 3.8.12; 3.9.0 to before 3.9.7 | Vulnerable | python-pillow |
| cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* | before 14.8 | Vulnerable | Apple |
| cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* | before 14.8 | Vulnerable | Apple |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | before 11.6 | Vulnerable | Apple |
| cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* | before 15.0 | Vulnerable | Apple |
| cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* | before 8.0 | Vulnerable | Apple |
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions before 2.4.0 Vulnerable ·libexpat project
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions 3.6.0 to before 3.6.15; 3.7.0 to before 3.7.12; 3.8.0 to before 3.8.12; 3.9.0 to before 3.9.7 Vulnerable ·python-pillow
- cpe:2.3:o:apple:ipados:*:*:*:*:*:*:*:* Versions before 14.8 Vulnerable ·Apple
- cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* Versions before 14.8 Vulnerable ·Apple
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions before 11.6 Vulnerable ·Apple
- cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* Versions before 15.0 Vulnerable ·Apple
- cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* Versions before 8.0 Vulnerable ·Apple
Remediation
- Fix · CNA libexpat Fixed in 2.4.0
Red Hat 6 advisories
- RHSA-2025:22871 Released 2025-12-09 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) expat-2.2.10-1.el8_2
- RHSA-2025:22842 Released 2025-12-09 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.6) expat-2.2.10-1.el8_6
- Red Hat Enterprise Linux BaseOS E4S (v.8.6) expat-2.2.10-1.el8_6
- Red Hat Enterprise Linux BaseOS TUS (v.8.6) expat-2.2.10-1.el8_6
- RHSA-2025:22785 Released 2025-12-04 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS AUS (v.8.4) expat-2.2.10-1.el8_4
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) expat-2.2.10-1.el8_4
Show 3 more Red Hat advisories
- RHSA-2025:22607 Released 2025-12-02 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS E4S (v.8.8) expat-2.2.10-1.el8_8
- Red Hat Enterprise Linux BaseOS TUS (v.8.8) expat-2.2.10-1.el8_8
- RHSA-2025:22035 Released 2025-11-25 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS E4S (v.9.0) expat-2.2.10-12.el9_0.4
- RHSA-2025:21776 Released 2025-11-19 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS (v. 8) expat-2.5.0-1.el8_10, expat-devel-2.5.0-1.el8_10
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | — |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2025:21776 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | — |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2025:22871 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.4) | Fixed | RHSA-2025:22785 |
| Red Hat Enterprise Linux BaseOS AUS (v.8.6) | Fixed | RHSA-2025:22842 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.6) | Fixed | RHSA-2025:22842 |
| Red Hat Enterprise Linux BaseOS E4S (v.8.8) | Fixed | RHSA-2025:22607 |
| Red Hat Enterprise Linux BaseOS E4S (v.9.0) | Fixed | RHSA-2025:22035 |
| Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) | Fixed | RHSA-2025:22785 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.6) | Fixed | RHSA-2025:22842 |
| Red Hat Enterprise Linux BaseOS TUS (v.8.8) | Fixed | RHSA-2025:22607 |
Not affected: 10 products
- Red Hat Enterprise Linux AppStream E4S (v.9.0)
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
- Red Hat Enterprise Linux BaseOS AUS (v.8.4)
- Red Hat Enterprise Linux BaseOS AUS (v.8.6)
- Red Hat Enterprise Linux BaseOS E4S (v.8.6)
- Red Hat Enterprise Linux BaseOS E4S (v.8.8)
- Red Hat Enterprise Linux BaseOS E4S (v.9.0)
- Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
- Red Hat Enterprise Linux BaseOS TUS (v.8.6)
- Red Hat Enterprise Linux BaseOS TUS (v.8.8)
Timeline
- 2026-10-02 Threatist record created from CVE-2013-0340
- 2026-10-03 Alias added: GHSA-w3v2-46wf-pq33
- 2026-10-10 CISA SSVC decision points changed
- 2026-11-05 Affected versions changed · Red Hat
References
Exploit 1
Advisory 18
- [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments
- GLSA-201701-21
- https://support.apple.com/kb/HT212805
- https://support.apple.com/kb/HT212804
- https://support.apple.com/kb/HT212807
- https://support.apple.com/kb/HT212819
- https://support.apple.com/kb/HT212814
- https://support.apple.com/kb/HT212815
- 20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15
- 20210921 APPLE-SA-2021-09-20-2 watchOS 8
- 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina
- 20210921 APPLE-SA-2021-09-20-3 tvOS 15
- 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8
- 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6
- [oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs
- 20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8
- 20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15
- 20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15
Sources
- CVE-2013-0340 · CVE Program
- CVE-2013-0340 · NVD
- FIRST EPSS
- GHSA-w3v2-46wf-pq33 · GitHub Advisory Database · CC BY 4.0
- CVE-2013-0340 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences