Fluid Attacks Database

Description

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
alpine v3.22	expat	>=0 <2.6.0-r0	2.6.0-r0
debian 12	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
alpine v3.16	expat	>=0 <2.6.0-r0	2.6.0-r0
alpine v3.17	expat	>=0 <2.6.0-r0	2.6.0-r0
alpine v3.18	expat	>=0 <2.6.0-r0	2.6.0-r0
alpine v3.19	expat	>=0 <2.6.0-r0	2.6.0-r0
alpine v3.20	expat	>=0 <2.6.0-r0	2.6.0-r0
alpine v3.21	expat	>=0 <2.6.0-r0	2.6.0-r0
debian 12	expat	=2.5.0-1 \|\| =2.5.0-1+deb12u1 \|\| =2.5.0-1+deb12u2 \|\| =2.5.0-1+deb12u3 \|\| =2.5.0-1+deb12u4 \|\| =2.5.0-2 \|\| =2.6.0-1 \|\| =2.6.1-1 \|\| =2.6.1-2 \|\| =2.6.2-1 \|\| =2.6.2-2 \|\| =2.6.3-1 \|\| =2.6.3-2 \|\| =2.6.4-1 \|\| =2.7.0-1 \|\| =2.7.1-1 \|\| =2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| =2.8.2-1 \|\| =2.8.2-1~deb13u1 \|\| =2.8.3-1 \|\| =2.8.3-1~deb13u1 \|\| =2.8.4-1 \|\| =2.8.4-2 \|\| =2.8.5-1 \|\| =2.8.5-2 \|\| =2.9.0-1	-
debian 13	expat	>=0 <2.6.0-1	2.6.0-1

1-10 of 18

Aliases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.