The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-expat | Sep 20, 2017 | Jun 16, 2016 | |
| Apple Itunes | apple-itunes-upgrade-latest | Mar 24, 2017 | Jun 16, 2016 | |
| Debian | debian-upgrade-expat | Jun 7, 2016 | Jun 7, 2016 | |
| F5 Big Ip | f5-bigip-upgrade-latest | Jun 17, 2026 | Oct 26, 2016 | |
| Freebsd | freebsd-upgrade-package-expatfreebsd-upgrade-package-python27 | Oct 11, 2017 | Jun 9, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-dev-libs-expat | Oct 30, 2017 | Jun 16, 2016 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-expathuawei-euleros-2_0_sp2-upgrade-expat-devel | Jul 23, 2019 | Jun 16, 2016 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-expathuawei-euleros-2_0_sp3-upgrade-expat-devel | Sep 25, 2019 | Jun 16, 2016 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-expathuawei-euleros-2_0_sp5-upgrade-expat-devel | Jun 27, 2019 | Jun 16, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-library-expat-2-2-0-0-175-3-11-0-4-0 | May 29, 2017 | Jun 16, 2016 | |
| Redhat_linux | no-fix-redhat-rpm-package | Jul 9, 2025 | Jun 4, 2016 | |
| Suse | — | suse-upgrade-expatsuse-upgrade-libexpat-develsuse-upgrade-libexpat1suse-upgrade-libexpat1-32bitsuse-upgrade-libexpat1-x86suse-upgrade-sles12-docker-imagesuse-upgrade-sles12sp1-docker-imagesuse-upgrade-sles12sp2-docker-image | Feb 3, 2017 | Jun 16, 2016 |
| Ubuntu | ubuntu-upgrade-lib64expat1ubuntu-upgrade-libexpat1ubuntu-upgrade-libxmlrpc-c-4ubuntu-upgrade-libxmlrpc-core-c3 | Jun 20, 2016 | Jun 16, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub