XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade expat | Aug 22, 2024 | Jul 25, 2017 |
| Apple Osx Libexpat | — | Upgrade macOS to the latest version | Sep 26, 2017 | Jul 25, 2017 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Jul 25, 2017 |
| Debian | — | Upgrade expat | Jun 18, 2017 | Jun 18, 2017 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Mar 27, 2019 |
| Freebsd | — | Upgrade expatUpgrade libwwwUpgrade python27 | Oct 11, 2017 | Oct 11, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade expat-develUpgrade expat | Dec 4, 2019 | Jul 25, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade expat-develUpgrade expat | Nov 19, 2019 | Jul 25, 2017 |
| Huawei Euleros 2_0_sp5 | — | Upgrade expatUpgrade expat-devel | Sep 12, 2019 | Jul 25, 2017 |
| Ibm Http_server | — | Apply IBM HTTP Server version 9.0.5.15 or laterApply IBM HTTP Server version 8.5.5.23 or laterApply IBM HTTP Server version 8.0.0.16 or laterApply IBM HTTP Server version 7.0.0.46 or laterApply IBM HTTP Server Interim Fix PH50316 | Nov 20, 2025 | Nov 22, 2022 |
| Oracle Solaris | — | Upgrade library/expat to version 2.2.1-0.175.3.24.0.3.0 on Solaris 11.3 | Sep 19, 2017 | Jul 25, 2017 |
| Red Hat Jboss Eap | — | — | Sep 19, 2024 | Jun 14, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 14, 2017 |
| Suse | — | Upgrade expatUpgrade sles12sp1-docker-imageUpgrade libexpat1Upgrade sles12-docker-imageUpgrade python3-tkUpgrade python3-develUpgrade python3-cursesUpgrade libexpat-develUpgrade libpython3_4m1_0Upgrade sles12sp2-docker-imageUpgrade libpython3_4m1_0-32bitUpgrade python3-baseUpgrade python3Upgrade python3-dbmUpgrade libexpat1-32bitUpgrade libexpat1-x86 | Aug 30, 2017 | Jun 18, 2017 |
| Ubuntu | — | Upgrade libcoin80 (Ubuntu Pro)Upgrade libcoin80v5 (Ubuntu Pro)Upgrade lib64expat1Upgrade libexpat1Upgrade libcoin80-runtime (Ubuntu Pro) | Jul 19, 2017 | Jun 18, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub