{
  "cveId": "CVE-2013-0340",
  "url": "https://patchblox.com/security/cve/CVE-2013-0340",
  "summary": "CVE-2013-0340 is fixed in 3 products on 2 platforms, first by Python 3.9 3.9.7, released August 30, 2021. 3 other affected products have no fix yet. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Python 3.8 and 3 others: expat before version 2.4.0 does not properly handle entities expansion unless an application developer\u2026",
  "description": "expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.",
  "published": "2014-01-21T18:55:09Z",
  "severity": "Important",
  "cvss": 6.8,
  "epss": 0.19433,
  "epssPercentile": 0.9738,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://nvd.nist.gov/vuln/detail/CVE-2013-0340",
  "fixes": [
    {
      "platform": "windows-app",
      "product": "Python 3.9",
      "fixedVersion": "3.9.7",
      "fix": "Python 3.9 3.9.7",
      "url": "https://patchblox.com/security/fix/windows-app/python.python.3.9-3.9.7",
      "released": "2021-08-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "expat",
      "release": "RHEL 8",
      "fixedVersion": "0:2.5.0-1.el8_10",
      "fix": "RHSA-2025:21776",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2025-21776",
      "released": "2025-11-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "expat",
      "release": "RHEL 9",
      "fixedVersion": "0:2.4.9-1.el9_1",
      "fix": "RHBA-2022:8290",
      "url": "https://patchblox.com/security/fix/linux/rhba-2022-8290",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "expat",
      "release": "almalinux 8",
      "fixedVersion": "2.5.0-1.el8_10",
      "fix": "ALSA-2025:21776",
      "url": "https://patchblox.com/security/fix/linux/alsa-2025-21776",
      "released": "2025-11-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "expat-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:2.5.0-1.el8_10",
      "fix": "RHSA-2025:21776",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2025-21776",
      "released": "2025-11-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "expat-devel",
      "release": "RHEL 9",
      "fixedVersion": "0:2.4.9-1.el9_1",
      "fix": "RHBA-2022:8290",
      "url": "https://patchblox.com/security/fix/linux/rhba-2022-8290",
      "released": "2022-11-15T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "expat-devel",
      "release": "almalinux 8",
      "fixedVersion": "2.5.0-1.el8_10",
      "fix": "ALSA-2025:21776",
      "url": "https://patchblox.com/security/fix/linux/alsa-2025-21776",
      "released": "2025-11-19T00:00:00Z"
    }
  ],
  "noFixYet": [
    {
      "platform": "Windows apps",
      "product": "Python 3.6",
      "status": "no-fix",
      "affectedVersion": "3.6.8"
    },
    {
      "platform": "Windows apps",
      "product": "Python 3.7",
      "status": "no-fix",
      "affectedVersion": "3.7.9"
    },
    {
      "platform": "Windows apps",
      "product": "Python 3.8",
      "status": "no-fix",
      "affectedVersion": "3.8.10"
    }
  ],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}