PT-2024-3924 · Libexpat+5 · Libexpat+5

Published 2024-02-04 · Updated 2026-04-01 · CVE-2023-52426

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: libexpat versions through 2.5.0

Description: The issue is related to the incorrect limitation of recursive references to objects in DTD, which can lead to a denial of service. This is caused by recursive XML Entity Expansion if XML DTD is undefined at compile time.

Recommendations: For libexpat versions through 2.5.0, consider defining XML DTD at compile time to prevent recursive XML Entity Expansion. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

XML Entity Expansion

Weakness Enumeration

CWE-776

Related Identifiers

ALT-PU-2024-17539

AZL-34208

AZL-34684

BDU:2024-04334

CLEANSTART-2026-EM10970

CLEANSTART-2026-MH09144

CLEANSTART-2026-YT18139

CVE-2023-52426

ECHO-3235-462B-0D89

OESA-2024-1379

OPENSUSE-SU-2024:13695-1

ROSA-SA-2025-2604

SUSE-SU-2025:20207-1

SUSE-SU-2025:20311-1

Affected Products

Alt Linux

Astra Linux

Debian

Ibm Aix

Red Os

Libexpat

References · 122

• https://github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404 · Vendor Advisory
• https://github.com/libexpat/libexpat/pull/777 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22823 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:20207-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32767 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25314 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-EM10970 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1379 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22827 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-22822 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25315 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23990 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28757 · Security Note