Description
expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | libexpat | < 2.4.0 | 2.4.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | expat | 2.4.1-2 | — |
| Debian 13 | expat | 2.4.1-2 | — |
| Debian 12 | expat | 2.4.1-2 | — |
| Debian 12 | libxmltok | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | expat +1 | 2.4.9-1.el9_1 | RHBA-2022:8290 |
| RHEL 8 | expat +1 | 2.5.0-1.el8_10 | RHSA-2025:21776 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 E4S | expat | 2.2.10-12.el9_0.4 | RHSA-2025:22035 |
| RHEL 8.8 TUS | expat | 2.2.10-1.el8_8 | RHSA-2025:22607 |
| RHEL 8.8 E4S | expat | 2.2.10-1.el8_8 | RHSA-2025:22607 |
| RHEL 8.6 TUS | expat | 2.2.10-1.el8_6 | RHSA-2025:22842 |
| RHEL 8.6 E4S | expat | 2.2.10-1.el8_6 | RHSA-2025:22842 |
| RHEL 8.6 AUS | expat | 2.2.10-1.el8_6 | RHSA-2025:22842 |
| RHEL 8.4 EUS Long Life | expat | 2.2.10-1.el8_4 | RHSA-2025:22785 |
| RHEL 8.4 AUS | expat | 2.2.10-1.el8_4 | RHSA-2025:22785 |
| RHEL 8.2 AUS | expat | 2.2.10-1.el8_2 | RHSA-2025:22871 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | expat +1 | 2.5.0-1.el8_10 | ALSA-2025:21776 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | expat | 2.7.1-slfo.1.1_1.1 | SUSE-SU-2025:20311-1 |
| SLE Micro 6.0 | expat | 2.7.1-1.1 | SUSE-SU-2025:20207-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | expat | 2.4.1-1.2 | openSUSE-SU-2024:10748-1 |
| openSUSE Tumbleweed | python38 | 3.8.12-1.2 | openSUSE-SU-2024:11285-1 |
Advisories 16
- ALSA-2025:21776 Important: expat security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:22871 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:22842 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:22607 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:22785 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:22035 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2025:21776 Red Hat Security Advisory: expat security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- RHBA-2022:8290 Red Hat Bug Fix Advisory: expat bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- SUSE-SU-2025:20311-1 Security update for expat SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20207-1 Security update for expat SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:11285-1 python38-3.8.12-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10748-1 expat-2.4.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
- WID-SEC-2025-1459 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 3, 2025
- WID-SEC-2022-2399 IBM Notes: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Dec 22, 2022
References
- [oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion mailing-list
- [oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments mailing-list
- 90634 vdb-entry
- 1028213 vdb-entry
- GLSA-201701-21 vendor-advisory
- 58233 vdb-entry
- https://support.apple.com/kb/HT212805
- https://support.apple.com/kb/HT212804
- https://support.apple.com/kb/HT212807
- https://support.apple.com/kb/HT212819
- https://support.apple.com/kb/HT212814
- https://support.apple.com/kb/HT212815
- 20210921 APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15 mailing-list
- 20210921 APPLE-SA-2021-09-20-2 watchOS 8 mailing-list
- 20210921 APPLE-SA-2021-09-20-8 Additional information for APPLE-SA-2021-09-13-4 Security Update 2021-005 Catalina mailing-list
- 20210921 APPLE-SA-2021-09-20-3 tvOS 15 mailing-list
- 20210921 APPLE-SA-2021-09-20-6 Additional information for APPLE-SA-2021-09-13-1 iOS 14.8 and iPadOS 14.8 mailing-list
- 20210921 APPLE-SA-2021-09-20-7 Additional information for APPLE-SA-2021-09-13-3 macOS Big Sur 11.6 mailing-list
- [announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs mailing-list
- [openoffice-users] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs mailing-list
- [oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs mailing-list
- 20211027 APPLE-SA-2021-10-26-10 Additional information for APPLE-SA-2021-09-20-2 watchOS 8 mailing-list
- 20211027 APPLE-SA-2021-10-26-11 Additional information for APPLE-SA-2021-09-20-3 tvOS 15 mailing-list
- 20211027 APPLE-SA-2021-10-26-9 Additional information for APPLE-SA-2021-09-20-1 iOS 15 and iPadOS 15 mailing-list
- Expat 2.4.0 and 2.4.1 Changelog