CVE-2017-9233High· 7.5▾ TwilightXML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 1.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
8.7%
XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
libexpat <= 2.2.0python >= 2.7.0, < 2.7.15python >= 3.3.0, < 3.3.7python >= 3.4.0, < 3.4.7python >= 3.5.0, < 3.5.4python >= 3.6.0, < 3.6.2debian_linux = 8.0debian_linux = 9.0debian_linux = 10.0Upgrade past the affected range:
python 3.6.2Connected by shared product, vendor, weakness, or advisory.
CVE-2020-36227High· 7.5A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.
CVE-2026-32777Medium· 4.0libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2018-20843High· 7.5In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service a…
CVE-2013-0340Medium· 6.8expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HT…
CVE-2017-13728High· 7.5There is an infinite loop in the next_char function in comp_scan.c in ncurses 6.0, related to libtic
CVE-2017-16932High· 7.5parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.