Vulnerability · Published Mar 14, 2025 · Assigned by redhat
CVE-2024-8176Libexpat: expat: improper restriction of xml entity expansion depth in libexpat
High 7.5
In plain English
A high-severity security flaw in libexpat. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.4%top 28.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | expat | 2.7.1-1.el10_0 | ALSA-2025:7512 |
| AlmaLinux:8 | expat | 2.2.5-17.el8_10 | ALSA-2025:3913 |
| AlmaLinux:9 | expat | 2.5.0-5.el9_6 | ALSA-2025:7444 |
| AlmaLinux:9 | expat | 2.5.0-3.el9_5.3 | ALSA-2025:3531 |
| AlmaLinux:10 | expat-devel | 2.7.1-1.el10_0 | ALSA-2025:7512 |
| AlmaLinux:8 | expat-devel | 2.2.5-17.el8_10 | ALSA-2025:3913 |
| AlmaLinux:9 | expat-devel | 2.5.0-5.el9_6 | ALSA-2025:7444 |
| AlmaLinux:9 | expat-devel | 2.5.0-3.el9_5.3 | ALSA-2025:3531 |
| AlmaLinux:8 | xmlrpc-c | 1.51.0-11.el8_10 | ALSA-2025:4048 |
| AlmaLinux:8 | xmlrpc-c-c++ | 1.51.0-11.el8_10 | ALSA-2025:4048 |
| AlmaLinux:8 | xmlrpc-c-client | 1.51.0-11.el8_10 | ALSA-2025:4048 |
| AlmaLinux:8 | xmlrpc-c-client++ | 1.51.0-11.el8_10 | ALSA-2025:4048 |
| AlmaLinux:8 | xmlrpc-c-devel | 1.51.0-11.el8_10 | ALSA-2025:4048 |
| Alpine:v3.20 | expat | 2.7.0-r0 | ALPINE-CVE-2024-8176 |
| Alpine:v3.21 | expat | 2.7.0-r0 | ALPINE-CVE-2024-8176 |
| Alpine:v3.22 | expat | 2.7.0-r0 | ALPINE-CVE-2024-8176 |
| Alpine:v3.23 | expat | 2.7.0-r0 | ALPINE-CVE-2024-8176 |
| Alpine:v3.24 | expat | 2.7.0-r0 | ALPINE-CVE-2024-8176 |
| Debian:12 | expat | 2.5.0-1+deb12u2 | DEBIAN-CVE-2024-8176 |
| Debian:13 | expat | 2.7.0-1 | DEBIAN-CVE-2024-8176 |
| Debian:14 | expat | 2.7.0-1 | DEBIAN-CVE-2024-8176 |
| Debian:12 | libxmltok | no fix listed | DEBIAN-CVE-2024-8176 |
| Rocky Linux:10 | expat | 0:2.7.1-1.el10_0 | RLSA-2025:7512 |
| Rocky Linux:8 | expat | 0:2.2.5-17.el8_10 | RLSA-2025:3913 |
| Rocky Linux:9 | expat | 0:2.5.0-3.el9_5.3 | RLSA-2025:3531 |
| Rocky Linux:8 | xmlrpc-c | 0:1.51.0-11.el8_10 | RLSA-2025:4048 |
| Ubuntu:22.04:LTS | cadaver | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:24.04:LTS | cadaver | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:25.10 | cadaver | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.04:LTS | cadaver | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.10 | cadaver | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:22.04:LTS | expat | 2.4.7-1ubuntu0.6 | USN-7424-1 |
| Ubuntu:22.04:LTS | expat | 2.4.7-1ubuntu0.6 | UBUNTU-CVE-2024-8176 |
| Ubuntu:24.04:LTS | expat | 2.6.1-2ubuntu0.3 | USN-7424-1 |
| Ubuntu:24.04:LTS | expat | 2.6.1-2ubuntu0.3 | UBUNTU-CVE-2024-8176 |
| Ubuntu:25.10 | expat | 2.7.1-1 | UBUNTU-CVE-2024-8176 |
| Ubuntu:22.04:LTS | insighttoolkit4 | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:22.04:LTS | matanza | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:24.04:LTS | matanza | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:25.10 | matanza | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.04:LTS | matanza | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.10 | matanza | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:25.10 | swish-e | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.10 | swish-e | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:22.04:LTS | tdom | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:24.04:LTS | tdom | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:25.10 | tdom | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.04:LTS | tdom | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.10 | tdom | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:22.04:LTS | wbxml2 | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:24.04:LTS | wbxml2 | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:25.10 | wbxml2 | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.04:LTS | wbxml2 | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.10 | wbxml2 | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:25.10 | xmlrpc-c | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.04:LTS | xmlrpc-c | no fix listed | UBUNTU-CVE-2024-8176 |
| Ubuntu:26.10 | xmlrpc-c | no fix listed | UBUNTU-CVE-2024-8176 |
Affected products (as reported)
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- RHSA-2025:13681 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:22033 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:22034 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:22035 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:22607 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:22785 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:22842 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:22871 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3531 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3734 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:3913 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4048 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4446 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4447 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4448 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:4449 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7444 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:7512 vendor-advisory, x_refsource_REDHAT
- RHSA-2025:8385 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-8176 vdb-entry, x_refsource_REDHAT
- RHBZ#2310137 issue-tracking, x_refsource_REDHAT
- https://github.com/libexpat/libexpat/issues/893
- https://github.com/libexpat/libexpat/pull/973
- http://www.openwall.com/lists/oss-security/2025/03/15/1
- https://blog.hartwork.org/posts/expat-2-7-0-released/
- https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52
- https://bugzilla.suse.com/show_bug.cgi?id=1239618
- https://ubuntu.com/security/CVE-2024-8176
- https://security-tracker.debian.org/tracker/CVE-2024-8176
- https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53
- https://security.netapp.com/advisory/ntap-20250328-0009/
- https://www.kb.cert.org/vuls/id/760160
- http://seclists.org/fulldisclosure/2025/May/12
- http://seclists.org/fulldisclosure/2025/May/11
- http://seclists.org/fulldisclosure/2025/May/10
- http://seclists.org/fulldisclosure/2025/May/8
- http://seclists.org/fulldisclosure/2025/May/7
- http://seclists.org/fulldisclosure/2025/May/6
- http://www.openwall.com/lists/oss-security/2025/09/24/11
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html