Veille CVE

Recherche « libexpat »

27 CVE

Critique 0 Élevée 9 Moyenne 18 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « libexpat » ✕
  1. CVE-2026-115506 7.5 Élevée

    libexpat

    libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.

  2. CVE-2026-113351 5.9 Moyenne

    libexpat

    libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.

  3. CVE-2026-77214 8.2 Élevée

    libexpat

    libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.

  4. CVE-2026-102633 5.9 Moyenne

    libexpat

    libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

  5. CVE-2026-76875 5.3 Moyenne

    PyPy

    PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function that allows attackers to corrupt memory by supplying a crafted XML document to applications that create external-entity sub-parsers without retaining a reference to the parent parser. The child parser retains a raw C back-pointer to the parent parser struct while PyPy's tracing garbage collector can free the parent's C struct, causing bundled libexpat to dereference the freed pointer on every parsed token, producing memory corruption.

  6. CVE-2026-93990 7.5 Élevée

    libexpat

    Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted. Attackers can supply UTF-16 encoded XML containing lone high surrogates that consume the following code unit, causing Expat to pass unpaired surrogates to applications built with XML_UNICODE and to silently replace input characters in other builds.

  7. CVE-2026-76641 7.5 Élevée

    libexpat

    Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

  8. CVE-2026-76957 7.8 Élevée

    libexpat project libexpat

    libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.

  9. CVE-2026-76956 7.5 Élevée

    libexpat project libexpat

    In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.

  10. CVE-2026-66046 7.5 Élevée

    libexpat project libexpat

    Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.

  11. CVE-2026-72522 6.2 Moyenne

    libexpat project libexpat

    libexpat before 2.8.3 has an out-of-bounds read and resultant infinite loop because low surrogates are treated the same as high surrogates during Unicode processing in the *_toUtf16 functions.

  12. CVE-2026-56412 5.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.

  13. CVE-2026-56411 6.9 Moyenne

    libexpat project libexpat

    xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.

  14. CVE-2026-56410 6.9 Moyenne

    libexpat project libexpat

    xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.

  15. CVE-2026-56409 6.5 Moyenne

    libexpat project libexpat

    xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.

  16. CVE-2026-56408 6.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 has an integer overflow in copyString.

  17. CVE-2026-56407 6.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.

  18. CVE-2026-56406 6.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.

  19. CVE-2026-56405 6.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 has an integer overflow in getAttributeId.

  20. CVE-2026-56404 6.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 has an integer overflow in addBinding.

  21. CVE-2026-56403 6.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 has an integer overflow in storeAtts.

  22. CVE-2026-56132 6.9 Moyenne

    libexpat project libexpat

    In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.

  23. CVE-2026-56131 4.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).

  24. CVE-2026-49472 5.3 Moyenne

    signalwire freeswitch · Freeswitch freeswitch

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.11.0, FreeSWITCH includes a vulnerable function, PREFIX(prologTok)(), in libs/xmlrpc-c/lib/expat/xmltok/xmltok_impl.c, which was cloned from an outdated and vulnerable version in libexpat/libexpat. The function did not receive the corresponding security patch. This issue has been patched in version 1.11.0.

  25. CVE-2026-50219 5.9 Moyenne

    libexpat project libexpat

    libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,

  26. CVE-2026-7210 7.5 Élevée

    Python Software Foundation CPython · Python python

    `xml.parsers.expat` and `xml.etree.ElementTree` use insufficient entropy for Expat hash-flooding protection, which allows a crafted XML document to trigger hash flooding.\r\n\r\nFully mitigating this vulnerability requires both updating libexpat to 2.8.0 or later and applying this patch.

  27. CVE-2026-45186 7.5 Élevée

    libexpat project libexpat · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.