Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 75

Export CSV
CVE-2026-45186

libexpat: denial of service via crafted XML input

In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-32778

libexpat: libexpat: Denial of Service via NULL pointer dereference after out-of-memory condition

libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-32777

libexpat: libexpat: Denial of Service via infinite loop in DTD content parsing

libexpat before 2.7.5 allows an infinite loop while parsing DTD content.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-32776

libexpat: libexpat: Denial of Service due to NULL pointer dereference

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-25210

libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-24515

libexpat: libexpat null pointer dereference

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-102633

libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Libexpat Libexpat Project
Products
Expat Libexpat
CVE-2025-59375

expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-117610

libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-118370

libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-115506

libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay

libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2026-113351

libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2023-52426

expat: recursive XML entity expansion vulnerability

libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libexpat Project
Products
Libexpat
CVE-2022-43680

expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate

In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Debian Fedoraproject Libexpat Project and 2 more
Products
Debian Linux Fedora Libexpat and 21 more