Read the docs
TI-2024-15801 Aliases CVE-2024-23807GHSA-8582-h585-f568

Apache Xerces C++: Use-after-free on external DTD scan

Priority MEDIUM 46CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-416 and the CVSS impact.

Summary

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via the DOM using a standard parser feature, or via SAX using the XERCES_DISABLE_DTD environment variable. This issue has been disclosed before as CVE-2018-1311, but unfortunately that advisory incorrectly stated the issue would be fixed in version 3.2.3 or 3.2.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01482 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Apache Xerces C++ (Apache Software Foundation): 3.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Xerces C++3.0.0 to before 3.2.53.2.5Patch availableCNA
  • Apache Xerces C++ VendorApache Affected 3.0.0 to before 3.2.5 Fixed in 3.2.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:xerces-c\+\+:*:*:*:*:*:*:*:*3.0.0 to before 3.2.5VulnerableApache
  • cpe:2.3:a:apache:xerces-c\+\+:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.2.5 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Xerces C++ (Apache Software Foundation) Fixed in 3.2.5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise MRG 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-23807
  2. 2026-10-03 Alias added: GHSA-8582-h585-f568

References

Exploit 1

Patch 1

  • TI-2017-09352 NULL pointer dereference in Apache Xerces C++ CVSS 3.0CRITICAL 9.8
  • TI-2016-01924 Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3… CVSS 3.0CRITICAL 9.8
  • TI-2015-00221 internal/XMLReader.cpp in Apache Xerces-C before 3.1.2 allows remote attackers to cause a… CVSS 2.0MEDIUM 5.0
  • TI-2016-03837 Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent… CVSS 3.0HIGH 7.5
  • TI-2018-01214 Use after free in Apache Xerces-C CVSS 3.1HIGH 8.1
  • TI-2023-19135 HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3 CVSS 3.1HIGH 8.8
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences