Log in Start free

Vulnerability · Published Mar 10, 2024 · Assigned by mitre

CVE-2024-28757

High 7.5

In plain English

A high-severity security flaw in the expat package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.0%top 19.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8expat2.5.0-1.el8_10ALSA-2025:21776
AlmaLinux:9expat2.5.0-1.el9_3.1ALSA-2024:1530
AlmaLinux:8expat-devel2.5.0-1.el8_10ALSA-2025:21776
AlmaLinux:9expat-devel2.5.0-1.el9_3.1ALSA-2024:1530
Alpine:v3.20expat2.6.2-r0ALPINE-CVE-2024-28757
Alpine:v3.21expat2.6.2-r0ALPINE-CVE-2024-28757
Alpine:v3.22expat2.6.2-r0ALPINE-CVE-2024-28757
Alpine:v3.23expat2.6.2-r0ALPINE-CVE-2024-28757
Alpine:v3.24expat2.6.2-r0ALPINE-CVE-2024-28757
Debian:12expat2.5.0-1+deb12u4DEBIAN-CVE-2024-28757
Debian:13expat2.6.1-2DEBIAN-CVE-2024-28757
Debian:14expat2.6.1-2DEBIAN-CVE-2024-28757
Debian:12libxmltokno fix listedDEBIAN-CVE-2024-28757
Ubuntu:22.04:LTScadaverno fix listedUBUNTU-CVE-2024-28757
Ubuntu:24.04:LTScadaverno fix listedUBUNTU-CVE-2024-28757
Ubuntu:25.10cadaverno fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.04:LTScadaverno fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.10cadaverno fix listedUBUNTU-CVE-2024-28757
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.3USN-6694-1
Ubuntu:22.04:LTSexpat2.4.7-1ubuntu0.3UBUNTU-CVE-2024-28757
Ubuntu:22.04:LTSinsighttoolkit4no fix listedUBUNTU-CVE-2024-28757
Ubuntu:22.04:LTSlibxmltokno fix listedUBUNTU-CVE-2024-28757
Ubuntu:24.04:LTSlibxmltokno fix listedUBUNTU-CVE-2024-28757
Ubuntu:22.04:LTSmatanzano fix listedUBUNTU-CVE-2024-28757
Ubuntu:24.04:LTSmatanzano fix listedUBUNTU-CVE-2024-28757
Ubuntu:25.10matanzano fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.04:LTSmatanzano fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.10matanzano fix listedUBUNTU-CVE-2024-28757
Ubuntu:25.10swish-eno fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.10swish-eno fix listedUBUNTU-CVE-2024-28757
Ubuntu:22.04:LTStdomno fix listedUBUNTU-CVE-2024-28757
Ubuntu:24.04:LTStdomno fix listedUBUNTU-CVE-2024-28757
Ubuntu:25.10tdomno fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.04:LTStdomno fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.10tdomno fix listedUBUNTU-CVE-2024-28757
Ubuntu:22.04:LTSwbxml2no fix listedUBUNTU-CVE-2024-28757
Ubuntu:24.04:LTSwbxml2no fix listedUBUNTU-CVE-2024-28757
Ubuntu:25.10wbxml2no fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.04:LTSwbxml2no fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.10wbxml2no fix listedUBUNTU-CVE-2024-28757
Ubuntu:25.10xmlrpc-cno fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.04:LTSxmlrpc-cno fix listedUBUNTU-CVE-2024-28757
Ubuntu:26.10xmlrpc-cno fix listedUBUNTU-CVE-2024-28757

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-776 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References