Summary
Expat is a C library for parsing XML documents.
Security Fix(es):
* expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | expat | 2.5.0-1.el8_10 |
| AlmaLinux · 8 | expat-devel | 2.5.0-1.el8_10 |
Vulnerabilities 4
-
High 7.5CVE-2022-23990 Public exploit
Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
-
High 7.5CVE-2024-28757 Public exploit
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created vi…
-
High 7.5
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…
-
Unscored —CVE-2013-0340 EPSS 19%
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_Set…
References
-
report
https://access.redhat.com/security/cve/CVE-2025-59375
-
report
https://bugzilla.redhat.com/2395108
-
advisory
https://errata.almalinux.org/8/ALSA-2025-21776.html
-
report
https://www.redhat.com/security/data/cve/CVE-2013-0340.html
-
report
https://www.redhat.com/security/data/cve/CVE-2022-23990.html
-
report
https://www.redhat.com/security/data/cve/CVE-2024-28757.html