CVE-2018-20843High· 7.5▾ TwilightIn libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 1.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
7.1%
In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
libexpat < 2.2.7ubuntu_linux = 12.04ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 18.10ubuntu_linux = 19.04debian_linux = 8.0debian_linux = 9.0fedora = 29fedora = 30leap = 15.0leap = 15.1hospitality_res_3700 >= 5.7, <= 5.7.6http_server = 12.1.3.0http_server = 12.2.1.4.0outside_in_technology = 8.5.4outside_in_technology = 8.5.5nessus < 8.15.0Upgrade past the affected range:
libexpat 2.2.7nessus 8.15.0Connected by shared product, vendor, weakness, or advisory.
CVE-2019-15903High· 7.5In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based …
CVE-2013-0340Medium· 6.8expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HT…
CVE-2020-25649High· 7.5A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly
CVE-2024-28757High· 7.5libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2023-52425High· 7.5libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
CVE-2023-52426Medium· 5.5libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.