neon before 0.28.6, when expat is used, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Neon | — | Apply OS X security update 2010-007Upgrade macOS to the latest version | Dec 16, 2011 | Aug 21, 2009 |
| Centos_linux | — | Upgrade neonUpgrade gnome-vfs2-develUpgrade gnome-vfs2-smbUpgrade neon-develUpgrade gnome-vfs2 | Dec 1, 2016 | Aug 21, 2009 |
| Oracle_linux | — | Upgrade neon-develUpgrade gnome-vfs2Upgrade neonUpgrade gnome-vfs2-smbUpgrade gnome-vfs2-devel | Oct 16, 2024 | Aug 21, 2009 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Aug 18, 2009 |
| Suse | — | Upgrade libneon27-32bitUpgrade libneon27-x86Upgrade libneon-develUpgrade libneon27Upgrade neon | Feb 17, 2015 | Jun 28, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub