libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time

🗓️ 27 Jan 2026 00:00:00Reported by Broadcom Security ResponseType

broadcom🔗 support.broadcom.com👁 10 Views

libexpat up to 2.5.0 allows recursive XML entity expansion when XML_DTD is undefined at compile time.

Reporter	Title	Published	Views	Family All 108
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Netezza Analytics - NPS	11 Jul 202511:19	–	ibm
IBM Security Bulletins	Security Bulletin: A security vulnerability has been disclosed in Expat, which is installed as part of IBM Tivoli Network Manager (CVE-2023-52425).	21 Mar 202413:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	15 Apr 202502:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Expat component shipped with IBM Rational ClearCase ( CVE-2023-52426 )	4 Mar 202514:25	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service, SQL injection, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	24 Feb 202523:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	12 Dec 202402:18	–	ibm
IBM Security Bulletins	Security Bulletin: AIX is affected by multiple vulnerabilities due to Python (CVE-2023-52425, CVE-2023-52426, CVE-2023-6597)	11 Apr 202422:15	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability has been found in IBM Application Gateway	14 Nov 202503:30	–	ibm
Tenable Nessus	Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-524)	20 Feb 202400:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2025-1229)	28 Oct 202500:00	–	nessus