Fluid Attacks Database

Description

In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 11	expat	=2.2.10-2 \|\| =2.2.10-2+deb11u1 \|\| >=0 <2.2.10-2+deb11u2	2.2.10-2+deb11u2
alpine v3.14	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.16	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.20	expat	>=0 <2.4.5-r0	2.4.5-r0
alpine v3.21	expat	>=0 <2.4.5-r0	2.4.5-r0
debian 12	expat	>=0 <2.4.5-1	2.4.5-1
debian 12	libxmltok	=1.2-4 \|\| =1.2-4.1 \|\| =1.2-4.1~exp1 \|\| =1.2-4.2	-
alpine v3.12	expat	>=0 <2.2.10-r2	2.2.10-r2
alpine v3.13	expat	>=0 <2.2.10-r4	2.2.10-r4
alpine v3.15	expat	>=0 <2.4.5-r0	2.4.5-r0

1-10 of 31

Aliases

References

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.