Rapid7

vulnerability

Oracle Linux: CVE-2021-45960: ELSA-2022-0951: expat security update (IMPORTANT) (Multiple Advisories)

Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
Jan 17, 2022
Added
Mar 17, 2022
Modified
Dec 3, 2025

Description

In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
expat (libexpat) is susceptible to a software flaw that causes process interruption. When processing a large number of prefixed XML attributes on a single tag can libexpat can terminate unexpectedly due to buffer overrun. The highest threat from this vulnerability is to availability.

Solutions

oracle-linux-upgrade-expatoracle-linux-upgrade-expat-develoracle-linux-upgrade-expat-static
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.