Vendor
libexpat project
26 known vulnerabilities.
libexpat project at a glance
- Last 12 months
- 25
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 0 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 4 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 13 | 0 |
| May 2026 | 1 | 0 |
| Apr 2026 | 1 | 0 |
| Mar 2026 | 3 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 2 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 1 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 1 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
Products
26 results · Feed
-
Medium 4.9
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occu…
-
Medium 5.9
In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, …
-
High 7.5
Expat Denial of Service via storeAtts() Quadratic Complexity
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementTy…
-
Medium 6.2
libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same…
-
Medium 4.9
libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking…
-
Medium 6.9
xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
-
Medium 6.9
xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
-
Medium 6.5
xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in copyString.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Pars…
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in getAttributeId.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in addBinding.
-
Medium 6.9
libexpat before 2.8.2 has an integer overflow in storeAtts.
-
Medium 6.9
In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing arra…
-
Medium 4.9
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of …
-
Medium 4.9
libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_Par…
-
Low 2.9
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service vi…
-
Low 2.9
libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
-
Low 2.9
libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-mem…
-
Medium 4.0
libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
-
Medium 4.0
libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
-
Medium 6.9
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is n…
-
Low 2.9
In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
-
Low 2.9
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing…
-
High 7.5
libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that i…