JLSEC-2025-59 libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time...

🗓️ 14 Oct 2025 15:35:41Reported by GoogleType

osv

osv🔗 osv.dev👁 3 Views

Libexpat up to 2.5.0 allows recursive entity expansion when XML_DTD is undefined at compile time.

Reporter	Title	Published	Views	Family All 111
ibm	Security Bulletin: Vulnerabilities exists in IBM Netezza Analytics - NPS	11 Jul 202511:19	–	ibm
ibm	Security Bulletin: A security vulnerability has been disclosed in Expat, which is installed as part of IBM Tivoli Network Manager (CVE-2023-52425).	21 Mar 202413:05	–	ibm
ibm	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	15 Apr 202502:19	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities in Expat component shipped with IBM Rational ClearCase ( CVE-2023-52426 )	4 Mar 202514:25	–	ibm
ibm	Security Bulletin: Denial of service, SQL injection, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	24 Feb 202523:37	–	ibm
ibm	Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities	12 Dec 202402:18	–	ibm
ibm	Security Bulletin: AIX is affected by multiple vulnerabilities due to Python (CVE-2023-52425, CVE-2023-52426, CVE-2023-6597)	11 Apr 202422:15	–	ibm
ibm	Security Bulletin: Security vulnerability has been found in IBM Application Gateway	14 Nov 202503:30	–	ibm
nessus	Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2024-524)	20 Feb 202400:00	–	nessus
nessus	Amazon Linux 2023 : xmlrpc-c, xmlrpc-c-apps, xmlrpc-c-c++ (ALAS2023-2025-1229)	28 Oct 202500:00	–	nessus

Source	Link
cwe	www.cwe.mitre.org/data/definitions/776.html
github	www.github.com/libexpat/libexpat/commit/0f075ec8ecb5e43f8fdca5182f8cca4703da0404
github	www.github.com/libexpat/libexpat/pull/777
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
security	www.security.netapp.com/advisory/ntap-20240307-0005/

01 May 2026 18:01Current

7High risk

Vulners AI Score7

CVSS 3.15.5

EPSS0.00373

SSVC

libexpat recursive entity expansion undefined document type compile time