vulnerability
Amazon Linux 2023: CVE-2022-22822: Critical priority package update for expat
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:L/Au:N/C:P/I:P/A:P) | Jan 15, 2022 | Feb 17, 2025 | Jul 8, 2025 |
Severity
7
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Jan 15, 2022
Added
Feb 17, 2025
Modified
Jul 8, 2025
Description
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability confidentiality and integrity.
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag libexpat can terminate unexpectedly due to integer overflow. The highest threat from this vulnerability is to availability confidentiality and integrity.
Solutions
amazon-linux-2023-upgrade-expatamazon-linux-2023-upgrade-expat-debuginfoamazon-linux-2023-upgrade-expat-debugsourceamazon-linux-2023-upgrade-expat-develamazon-linux-2023-upgrade-expat-static
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.