Fluid Attacks Database

Description

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 13	expat	=2.7.1-2 \|\| =2.7.2-1 \|\| =2.7.3-1 \|\| =2.7.3-2 \|\| =2.7.4-1 \|\| =2.7.5-1 \|\| =2.8.0-1 \|\| =2.8.0-2 \|\| =2.8.1-1 \|\| >=0 <2.8.2-1~deb13u1	2.8.2-1~deb13u1
alpine v3.20	expat	>=0 <2.7.2-r0	2.7.2-r0
alpine v3.19	expat	>=0 <2.7.2-r0	2.7.2-r0
alpine v3.21	expat	>=0 <2.7.2-r0	2.7.2-r0
alpine v3.22	expat	>=0 <2.7.2-r0	2.7.2-r0
debian 12	expat	=2.5.0-1 \|\| =2.5.0-1+deb12u1 \|\| =2.5.0-1+deb12u2 \|\| =2.5.0-1+deb12u3 \|\| =2.5.0-1+deb12u4 \|\| >=0 <2.5.0-1+deb12u5	2.5.0-1+deb12u5
debian 14	expat	=2.7.1-2 \|\| >=0 <2.7.2-1	2.7.2-1
rpm rhel8.4	expat	<0:2.2.10-1.el8_4	0:2.2.10-1.el8_4
rpm rhel9.6	expat	<0:2.5.0-5.el9_6.1	0:2.5.0-5.el9_6.1
rpm rhel8	firefox	-	-

1-10 of 34

Aliases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.