In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD…
Priority MEDIUM 42CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 18 fixed, 5 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.
Summary
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.06643 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 11 advisoriesRed Hat: 18 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* | before 2.2.8 | Vulnerable | libexpat project |
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | 2.7.0 to before 2.7.17; 3.5.0 to before 3.5.8; 3.6.0 to before 3.6.10; 3.7.0 to before 3.7.5 | Vulnerable | python-pillow |
- cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:* Versions before 2.2.8 Vulnerable ·libexpat project
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.17; 3.5.0 to before 3.5.8; 3.6.0 to before 3.6.10; 3.7.0 to before 3.7.5 Vulnerable ·python-pillow
Remediation
Red Hat 11 advisories
- RHSA-2025:22871 Released 2025-12-09 · Red Hat rating Importantexpat security update
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2) expat-2.2.10-1.el8_2
- RHSA-2021:0949 Released 2021-03-22 · Red Hat rating LowRed Hat OpenShift Do openshift/odo-init-image 1.1.3 security update
- OpenShift Do 1 openshiftdo/odo-init-image-rhel7
- RHSA-2020:4484 Released 2020-11-04 · Red Hat rating Moderateexpat security update
- Red Hat Enterprise Linux BaseOS (v. 8) expat-2.2.5-4.el8, expat-devel-2.2.5-4.el8
Show 8 more Red Hat advisories
- RHSA-2020:3952 Released 2020-09-29 · Red Hat rating Moderateexpat security update
- Red Hat Enterprise Linux Client (v. 7) expat-2.1.0-12.el7
- Red Hat Enterprise Linux Client Optional (v. 7) expat-devel-2.1.0-12.el7, expat-static-2.1.0-12.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) expat-2.1.0-12.el7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) expat-devel-2.1.0-12.el7, expat-static-2.1.0-12.el7
- Red Hat Enterprise Linux Server (v. 7) expat-2.1.0-12.el7, expat-2.1.0-12.el7.ppc, expat-devel-2.1.0-12.el7 +1
- Red Hat Enterprise Linux Server Optional (v. 7) expat-static-2.1.0-12.el7, expat-static-2.1.0-12.el7.ppc
- Red Hat Enterprise Linux Workstation (v. 7) expat-2.1.0-12.el7, expat-devel-2.1.0-12.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) expat-static-2.1.0-12.el7
- RHSA-2020:2646 Released 2020-06-22 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update
- Red Hat JBoss Core Services
- RHSA-2020:2644 Released 2020-06-22 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.37 SP3 security update
- Red Hat JBoss Core Services on RHEL 6 Server jbcs-httpd24-curl-7.64.1-36.jbcs.el6, jbcs-httpd24-httpd-2.4.37-57.jbcs.el6, jbcs-httpd24-httpd-devel-2.4.37-57.jbcs.el6 +18
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-7.64.1-36.jbcs.el7, jbcs-httpd24-httpd-2.4.37-57.jbcs.el7, jbcs-httpd24-httpd-devel-2.4.37-57.jbcs.el7 +19
- RHSA-2019:3756 Released 2019-11-06 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux Desktop (v. 6) thunderbird-68.2.0-2.el6_10
- Red Hat Enterprise Linux Server Optional (v. 6) thunderbird-68.2.0-2.el6_10
- Red Hat Enterprise Linux Workstation (v. 6) thunderbird-68.2.0-2.el6_10
- RHSA-2019:3237 Released 2019-10-29 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux AppStream (v. 8) thunderbird-68.2.0-1.el8_0
- RHSA-2019:3210 Released 2019-10-29 · Red Hat rating Importantthunderbird security update
- Red Hat Enterprise Linux Client (v. 7) thunderbird-68.2.0-1.el7_7
- Red Hat Enterprise Linux Server Optional (v. 7) thunderbird-68.2.0-1.el7_7
- Red Hat Enterprise Linux Workstation (v. 7) thunderbird-68.2.0-1.el7_7
- RHSA-2019:3193 Released 2019-10-24 · Red Hat rating Criticalfirefox security update
- Red Hat Enterprise Linux Client (v. 7) firefox-68.2.0-1.el7_7
- Red Hat Enterprise Linux Client Optional (v. 7) firefox-68.2.0-1.el7_7
- Red Hat Enterprise Linux Server (v. 7) firefox-68.2.0-1.el7_7
- Red Hat Enterprise Linux Server Optional (v. 7) firefox-68.2.0-1.el7_7
- Red Hat Enterprise Linux Workstation (v. 7) firefox-68.2.0-1.el7_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) firefox-68.2.0-1.el7_7
- RHSA-2019:3196 Released 2019-10-24 · Red Hat rating Criticalfirefox security update
- Red Hat Enterprise Linux AppStream (v. 8) firefox-68.2.0-2.el8_0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Web Server 2 | Affected | No fix planned: Out of support scope |
| OpenShift Do 1 | Fixed | RHSA-2021:0949 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2019:3196, RHSA-2019:3237 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:4484 |
| Red Hat Enterprise Linux BaseOS AUS (v. 8.2) | Fixed | RHSA-2025:22871 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2019:3193, RHSA-2019:3210, RHSA-2020:3952 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2019:3193, RHSA-2020:3952 |
| Red Hat Enterprise Linux ComputeNode (v. 7) | Fixed | RHSA-2020:3952 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2020:3952 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2019:3756 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2019:3193, RHSA-2020:3952 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2019:3756 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2019:3193, RHSA-2019:3210, RHSA-2020:3952 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2019:3756 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2019:3193, RHSA-2019:3210, RHSA-2020:3952 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2019:3193, RHSA-2020:3952 |
| Red Hat JBoss Core Services | Fixed | RHSA-2020:2646 |
| Red Hat JBoss Core Services on RHEL 6 Server | Fixed | RHSA-2020:2644 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2020:2644 |
Not affected: 5 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux BaseOS AUS (v. 8.2)
Timeline
- 2026-10-02 Threatist record created from CVE-2019-15903
- 2026-10-03 Alias added: GHSA-w829-6hpw-frjf
References
Patch 2
Advisory 56
- USN-4132-1
- 20190917 [slackware-security] expat (SSA:2019-259-01)
- USN-4132-2
- FEDORA-2019-613edfe68b
- DSA-4530
- 20190923 [SECURITY] [DSA 4530-1] expat security update
- FEDORA-2019-9505c6b555
- openSUSE-SU-2019:2205
- openSUSE-SU-2019:2204
- FEDORA-2019-672ae0f060
- 20191021 [slackware-security] python (SSA:2019-293-01)
- USN-4165-1
- DSA-4549
- RHSA-2019:3210
- RHSA-2019:3237
- 20191101 [SECURITY] [DSA 4549-1] firefox-esr security update
- openSUSE-SU-2019:2420
- openSUSE-SU-2019:2424
- openSUSE-SU-2019:2425
- RHSA-2019:3756
- openSUSE-SU-2019:2447
- openSUSE-SU-2019:2451
- openSUSE-SU-2019:2452
- openSUSE-SU-2019:2459
- openSUSE-SU-2019:2464
- [debian-lts-announce] 20191110 [SECURITY] [DLA 1987-1] firefox-esr security update
- 20191118 [SECURITY] [DSA 4571-1] thunderbird security update
- DSA-4571
- [debian-lts-announce] 20191118 [SECURITY] [DLA 1997-1] thunderbird security update
- GLSA-201911-08
- USN-4202-1
- 20191211 APPLE-SA-2019-12-10-8 watchOS 6.1.1
- 20191211 APPLE-SA-2019-12-10-5 tvOS 13.3
- 20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra
- 20191213 APPLE-SA-2019-12-10-1 iOS 13.3 and iPadOS 13.3
- 20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra
- 20191213 APPLE-SA-2019-12-10-8 watchOS 6.1.1
- 20191213 APPLE-SA-2019-12-10-5 tvOS 13.3
- openSUSE-SU-2020:0010
- openSUSE-SU-2020:0086
- USN-4335-1
- https://www.oracle.com/security-alerts/cpuapr2020.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://github.com/libexpat/libexpat/issues/342
- http://packetstormsecurity.com/files/154503/Slackware-Security-Advisory-expat-Updates.html
- https://security.netapp.com/advisory/ntap-20190926-0004/
- http://packetstormsecurity.com/files/154927/Slackware-Security-Advisory-python-Updates.html
- http://packetstormsecurity.com/files/154947/Slackware-Security-Advisory-mozilla-firefox-Updates.html
- https://support.apple.com/kb/HT210788
- https://support.apple.com/kb/HT210790
- https://support.apple.com/kb/HT210785
- https://support.apple.com/kb/HT210789
- https://support.apple.com/kb/HT210793
- https://support.apple.com/kb/HT210795
- https://support.apple.com/kb/HT210794
- https://www.tenable.com/security/tns-2021-11
Sources
- CVE-2019-15903 · CVE Program
- CVE-2019-15903 · NVD
- FIRST EPSS
- GHSA-w829-6hpw-frjf · GitHub Advisory Database · CC BY 4.0
- CVE-2019-15903 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences