Name: CVE-2024-28757: Improper Restriction of Recursive Entity References in DTDs
Creator: Rapid7
Published: 2024-03-10T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2024-28757, CWE-776, CVSS 7.5, EPSS 0.02006

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVSS Details

CVSS 3.1 Base Score: 7.5
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade expatUpgrade expat-devel	Apr 4, 2024	Mar 10, 2024
Alpine Linux	—	Upgrade expat	Mar 26, 2024	Mar 10, 2024
Amazon_linux_2023	—	Upgrade xmlrpc-c-debuginfoUpgrade xmlrpc-c-appsUpgrade expat-staticUpgrade xmlrpc-c-apps-debuginfoUpgrade xmlrpc-c-client-debuginfoUpgrade xmlrpc-c-c++Upgrade expat-develUpgrade xmlrpc-c-clientUpgrade xmlrpc-c-client++Upgrade expat-debuginfoUpgrade expat-debugsourceUpgrade xmlrpc-c-client++-debuginfoUpgrade xmlrpc-cUpgrade expatUpgrade xmlrpc-c-c++-debuginfo	Feb 17, 2025	Mar 10, 2024
Debian	—	Upgrade expat	May 15, 2025	Mar 10, 2024
Dell Idrac	—	Upgrade Dell iDRAC to the latest version	Jul 15, 2026	Jul 14, 2026
F5 Big Ip	—	Update F5 BIG-IP to the latest version	Jun 17, 2026	May 16, 2024
Huawei Euleros 2_0_sp10	—	Upgrade expat	Jul 16, 2024	Mar 10, 2024
Huawei Euleros 2_0_sp11	—	Upgrade expat	Jun 26, 2024	Mar 10, 2024
Huawei Euleros 2_0_sp12	—	Upgrade expat	Oct 8, 2024	Mar 10, 2024
Huawei Euleros 2_0_sp9	—	Upgrade expat	Jul 17, 2024	Mar 10, 2024
Ibm Aix	—	Apply the fix or workaround for python_advisory9	Jun 14, 2024	Mar 10, 2024
Oracle_linux	—	Upgrade expatUpgrade expat-devel	Mar 27, 2024	Mar 10, 2024
Redhat Openshift	—	Upgrade ose-rhel-coreos	Aug 10, 2026	Mar 10, 2024
Redhat_linux	—	Upgrade expat-develUpgrade expat-debuginfoUpgrade expat-debugsourceUpgrade expat	Mar 27, 2024	Mar 10, 2024
Suse	—	Upgrade expatUpgrade libexpat1-32bitUpgrade libexpat-develUpgrade libexpat-devel-32bitUpgrade libexpat1	Apr 9, 2024	Mar 10, 2024
Ubuntu	—	Upgrade expatUpgrade libexpat1	Mar 15, 2024	Mar 10, 2024
Vmware Photon_os	—	Use 'tdnf update' to upgrade all packages to the latest version.	Jan 20, 2025	Mar 10, 2024

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritise with Active Threat Intelligence