Description
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | expat | 2.1.0~beta3-1 | — |
| Debian 14 | xmlrpc-c | 1.16.33-3.2 | — |
| Debian 13 | expat | 2.1.0~beta3-1 | — |
| Debian 13 | xmlrpc-c | 1.16.33-3.2 | — |
| Debian 12 | expat | 2.1.0~beta3-1 | — |
| Debian 12 | libxmltok | No fix yet | — |
| Debian 12 | xmlrpc-c | 1.16.33-3.2 | — |
| Debian 6.0 | expat | 2.0.1-7+squeeze1 | DSA-2525-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | cadaver +4 | No fix yet | — |
| Ubuntu 26.04 LTS | cadaver +3 | No fix yet | — |
| Ubuntu 25.10 | cadaver +4 | No fix yet | — |
| Ubuntu 24.04 LTS | cadaver +1 | No fix yet | — |
| Ubuntu 22.04 LTS | cadaver +1 | No fix yet | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | cadaver +1 | No fix yet | — |
| Ubuntu 18.04 LTS | vnc4 +2 | No fix yet | — |
| Ubuntu 16.04 LTS | cadaver +1 | No fix yet | — |
| Ubuntu Pro 26.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 24.04 LTS | libxmltok | 1.2-4.1ubuntu2.24.0.4.1+esm3 | USN-7307-1 |
| Ubuntu Pro 24.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 22.04 LTS | libxmltok | 1.2-4ubuntu0.22.04.1~esm5 | USN-7307-1, USN-5455-1 |
| Ubuntu Pro 22.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 20.04 LTS | libxmltok | 1.2-4ubuntu0.20.04.1~esm5 | USN-7307-1, USN-5455-1 |
| Ubuntu Pro 20.04 LTS | swish-e | No fix yet | — |
| Ubuntu Pro 18.04 LTS | coin3 +1 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | libxmltok | 1.2-4ubuntu0.18.04.1~esm5 | USN-7307-1, USN-5455-1 |
| Ubuntu Pro 16.04 LTS | libxmltok | 1.2-3ubuntu0.16.04.1~esm2 | USN-5455-1 |
| Ubuntu Pro 16.04 LTS | vnc4 +5 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | vnc4 +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | expat +1 | 2.0.1-11.el6_2 | RHSA-2012:0731 |
| RHEL 5 | expat +1 | 1.95.8-11.el5_8 | RHSA-2012:0731 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | expat | 2.2.0-3.1 | openSUSE-SU-2024:10077-1 |
Advisories 5
- RHSA-2012:0731 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Sep 21, 2026
- USN-5455-1 libxmltok vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- USN-7307-1 libxmltok vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-2525-1 expat - several Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10077-1 expat-2.2.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 49504 third-party-advisory
- USN-1527-1 vendor-advisory
- https://support.apple.com/HT205637
- 1034344 vdb-entry
- http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167
- 51040 third-party-advisory
- RHSA-2012:0731 vendor-advisory
- 52379 vdb-entry
- http://sourceforge.net/projects/expat/files/expat/2.1.0/
- RHSA-2016:0062 vendor-advisory
- APPLE-SA-2015-12-08-3 vendor-advisory
- DSA-2525 vendor-advisory
- MDVSA-2012:041 vendor-advisory
- http://sourceforge.net/tracker/?func=detail&atid=110127&aid=2958794&group_id=10127
- RHSA-2016:2957 vendor-advisory
- USN-1613-2 vendor-advisory
- 51024 third-party-advisory
- USN-1613-1 vendor-advisory