Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

Summary

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

Timeline

1. Mar 14, 2025, 8:19 AM UTCCVE published
2. Mar 14, 2025, 1:13 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: partial

3. Oct 21, 2026, 8:11 PM UTCRecord last updated

Affected versions

• libexpat

  fixed in 2.7.0

• expat

  Version range not reported

• expat

  Version range not reported

• xmlrpc-c

  Version range not reported

• expat

  Version range not reported

• xmlrpc-c

  Version range not reported

• expat

  Version range not reported

• xmlrpc-c

  Version range not reported

• expat

  Version range not reported

• xmlrpc-c

  Version range not reported

• xmlrpc-c

  Version range not reported

• expat

  Version range not reported

• xmlrpc-c

  Version range not reported

• expat

  Version range not reported

• xmlrpc-c

  Version range not reported

• expat

  Version range not reported

• xmlrpc-c

  Version range not reported

• xmlrpc-c

  Version range not reported

• expat

  Version range not reported

• expat

  Version range not reported

• expat

  Version range not reported

• expat

  Version range not reported

• expat

  Version range not reported

• expat

  Version range not reported

• expat

  Version range not reported

• devworkspace/devworkspace-project-clone-rhel9

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• discovery/discovery-ui-rhel9

  Version range not reported

• compat-expat1

  Version range not reported

• expat

  Version range not reported

• expat

  Version range not reported

• firefox

  Version range not reported

• thunderbird

  Version range not reported

• firefox

  Version range not reported

• lua-expat

  Version range not reported

• mingw-expat

  Version range not reported

• thunderbird

  Version range not reported

• firefox

  Version range not reported

• firefox:flatpak/firefox

  Version range not reported

• thunderbird

  Version range not reported

• thunderbird:flatpak/thunderbird

  Version range not reported

• openshift/ose-rhel-coreos-8

  Version range not reported

• openshift/ose-rhel-coreos-9

  Version range not reported

References 23