CVE-2024-28757

The CVE-2024-28757 entry concerns libexpat up to version 2.6.1, where XML External Entity (XXE) processing can be triggered when isolated external parsers are used (XML_ExternalEntityParserCreate). The impact is denial of service or resource exhaustion (availability impact: HIGH) with CVSS v3.1 b...

CVE-2024-50602

A crash vulnerability exists in libexpat versions before 2.6.4 . The root cause is located within the XML_ResumeParser function, where XML_StopParser can improperly stop or suspend a parser that has not yet been started. This flaw affects various systems, including Astra Linux , Amazon Linux 2 , ...