Fluid Attacks Database

Description

libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	expat	=2.5.0-1 \|\| =2.5.0-1+deb12u1 \|\| =2.5.0-1+deb12u2 \|\| =2.5.0-1+deb12u3 \|\| =2.5.0-1+deb12u4 \|\| =2.5.0-2 \|\| =2.6.0-1 \|\| =2.6.1-1 \|\| =2.6.1-2 \|\| =2.6.2-1 \|\| =2.6.2-2 \|\| =2.6.3-1 \|\| =2.6.3-2 \|\| =2.6.4-1 \|\| =2.7.0-1 \|\| =2.7.1-1 \|\| =2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| =2.8.2-1 \|\| =2.8.2-1~deb13u1 \|\| =2.8.3-1 \|\| =2.8.3-1~deb13u1 \|\| =2.8.4-1 \|\| =2.8.4-2 \|\| =2.8.5-1 \|\| =2.8.5-2	-
rpm rhel6	expat	-	-
rpm rhel9	expat	-	-
debian 14	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| >=0 <2.8.0-1	2.8.0-1
rpm rhel6	compat-expat1	-	-
rpm rhel8	mingw-expat	-	-
alpine v3.20	expat	>=0 <2.8.1-r0	2.8.1-r0
rpm rhel10	expat	-	-
rpm rhel7	expat	-	-
debian 13	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| >=0 <2.8.2-1~deb13u1	2.8.2-1~deb13u1

1-10 of 15

Aliases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.