# CVE-2023-52425: expat: This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) cause... CVE-2023-52425 is fixed in 27 products on 1 platform, first by expat 2.6.0-1, released February 4, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2023-52425 - Priority: High - CVSS: 7.5 (Medium) - EPSS: 0.0215 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Feb 4, 2024 ## Description This update for expat fixes the following issues: - CVE-2025-59375: denial of service (resource consumption) caused by processing malformed small documents (bsc#1249584). - CVE-2026-24515: NULL dereference (CWE-476) due to function XML_ExternalEntityParserCreate() failing to copy the encoding handler data passed to XML_SetUnknownEncodingHandler() from the parent to the subparser (bsc#1257144). - CVE-2026-25210: lack of buffer size check can lead to an integer overflow (bsc#1257496). - CVE-2026-32776: NULL pointer dereference when processing empty external parameter entities inside an entity declaration value (bsc#1259726). - CVE-2026-32777: denial of service due to infinite loop in DTD content parsing (bsc#1259711). - CVE-2026-32778: NULL pointer dereference in `setContext` on retry after an out-of-memory condition (bsc#1259729). - CVE-2026-41080: crafted XML document can cause a denial of service (bsc#1262263). - CVE-2026-45186: denial of service via moderately sized crafted XML input (bsc#1264713). - CVE-2026-50219: lack of handler call depth tracking for calls to XML_* functions from within handlers in cases of a policy violation (bsc#1267631). - CVE-2026-56131: lack of handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation (bsc#1268572). - CVE-2026-56132: heap-based buffer overflow in doProlog in xmlparse.c (bsc#1268573). - CVE-2026-56403,CVE-2026-56404,CVE-2026-56405,CVE-2026-56406, CVE-2026-56407,CVE-2026-56408,CVE-2026-56409,CVE-2026-56410, CVE-2026-56411,CVE-2026-56412: multiple integer overflow vulnerabilities (bsc#1275115). - CVE-2026-66046: denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function (bsc#1275732). - CVE-2026-72522: out-of-bounds read and resultant infinite loop due to low surrogates being treated the same as high surrogates during Unicode processing (bsc#1275594). - CVE-2026-76641: out-of-bounds read vulnerability that allows attackers to trigger memory corruption (bsc#1275915). - CVE-2026-76956: denial of service via hash flooding attacks (bsc#1275860). - CVE-2026-76957: lack of handler call depth tracking with custom encoding callbacks. Thus, a use- after-free can occur (bsc#1275859). - CVE-2026-77214: out-of-bounds read due to insufficient checks in `XML_ParseBuffer()` (bsc#1284334). - CVE-2026-93990: fails to validate low surrogates following high surrogates in UTF-16 input (bsc#1282347). - CVE-2026-102633: Denial of Service via integer overflow in expat_realloc (bsc#1283493). Update to 2.8.5 (jsc#PED-16154): * Bug fixes: * Fix an OOM-related memory leak on a failed overflow check * Fix memory alignment for architectures with 128bit pointers * Mark XML_SetHashSalt deprecated * CMake: only add /source-charset:utf-8 when /utf-8 is not present * lib: resolve undefined behavior from overshifting a signed int * lib: support read-only hash table lookup with non-zero-terminated keys * lib: use a C99 bool for ENTITY.open * version info bumped from 13:3:12 to 13:4:12 * fix support for 2+ GiB documents (regression from 2.8.2) * reject empty version in the XML declaration * fix printf format for AIX * CMake|AIX: enable EXPAT_DEV_URANDOM by default * version info bumped from 13:2:12 to 13:3:12 * Existing API function XML_SetHashSalt is now deprecated * because of its limitations, and its use should be * considered a vulnerability. Please either use the new API * function XML_SetHashSalt16Bytes (with known-high-quality * entropy input only!) instead, or leave the derivation of * a 16-bytes hash salt from high quality entropy to Expat's * internal machinery (by *not* calling either of the two * XML_SetHashSalt* functions). * xmlwf: Fix a memory leak * WASI: Fix format specifiers for 32bit WASI SDK * Fix alignment of internal allocations for some non-amd64 architectures (e.g. sparc32); fixes up on the fix to CVE-2025-59375 (of Expat 2.7.2) * Fix a class of false positives where input should have been rejected with error XML_ERROR_ASYNC_ENTITY; regression from CVE-2024-8176 (of Expat 2.7.0) * Prove and regression-proof absence of integer overflow from function expat_realloc * Remove 'harmless' cast that truncated a size_t to unsigned * xmlwf: Resolve use of functions XML_GetErrorLineNumber and XML_GetErrorColumnNumber * CVE-2025-59375 -- Disallow use of disproportional amounts of dynamic memory from within an Expat parser * xmlwf: Fix (internal) help generator * xmlwf: Mention supported environment variables in ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | expat Debian 11.6 (bullseye) | 2.2.10-2+deb11u6 | [DLA-3893-1](https://patchblox.com/security/data/fix/linux/dla-3893-1.md) | Sep 19, 2024 | | Linux | expat Debian 12.15 (bookworm) | 2.5.0-1+deb12u2 | [DEBIAN-CVE-2023-52425](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52425.md) | Feb 4, 2024 | | Linux | expat Debian 13.5 (trixie) | 2.6.0-1 | [DEBIAN-CVE-2023-52425](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52425.md) | Feb 4, 2024 | | Linux | expat Debian 14 | 2.6.0-1 | [DEBIAN-CVE-2023-52425](https://patchblox.com/security/data/fix/linux/debian-cve-2023-52425.md) | Feb 4, 2024 | | Linux | expat RHEL 8 | 0:2.2.5-11.el8_9.1 | [RHSA-2024:1615](https://patchblox.com/security/data/fix/linux/rhsa-2024-1615.md) | Apr 2, 2024 | | Linux | expat RHEL 9 | 0:2.5.0-1.el9_3.1 | [RHSA-2024:1530](https://patchblox.com/security/data/fix/linux/rhsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.3 | [expat 2.4.7-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-expat-2.4.7-1ubuntu0.3.md) | Mar 9, 2024 | | Linux | expat Ubuntu 24.04.5 LTS (noble) | 2.6.0-1 | [expat 2.6.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-expat-2.6.0-1.md) | Feb 4, 2024 | | Linux | expat Ubuntu 24.10 (oracular) | 2.6.0-1 | [expat 2.6.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-expat-2.6.0-1.md) | Jan 16, 2026 | | Linux | expat Ubuntu 25.04 (plucky) | 2.6.0-1 | [expat 2.6.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-expat-2.6.0-1.md) | Jan 16, 2026 | | Linux | expat almalinux 8 | 2.2.5-11.el8_9.1 | [ALSA-2024:1615](https://patchblox.com/security/data/fix/linux/alsa-2024-1615.md) | Apr 2, 2024 | | Linux | expat almalinux 9 | 2.5.0-1.el9_3.1 | [ALSA-2024:1530](https://patchblox.com/security/data/fix/linux/alsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat amzn 2023 | 2.6.3-1.amzn2023.0.1 | [ALAS2023-2024-759](https://patchblox.com/security/data/fix/linux/alas2023-2024-759.md) | Nov 13, 2024 | | Linux | expat ol 8 | 0:2.2.5-11.0.1.el8_9.1 | [ELSA-2024-1615](https://patchblox.com/security/data/fix/linux/elsa-2024-1615.md) | Apr 3, 2024 | | Linux | expat ol 9 | 0:2.5.0-1.el9_3.1 | [ELSA-2024-1530](https://patchblox.com/security/data/fix/linux/elsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat rocky 8 | 0:2.2.5-11.el8_9.1 | [RLSA-2024:1615](https://patchblox.com/security/data/fix/linux/rlsa-2024-1615.md) | Apr 5, 2024 | | Linux | expat sles 15.6 | 2.8.5-150400.3.40.1 | [SUSE-SU-2026:4623-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-4623-1.md) | Nov 7, 2026 | | Linux | expat-debuginfo amzn 2023 | 2.6.3-1.amzn2023.0.1 | [ALAS2023-2024-759](https://patchblox.com/security/data/fix/linux/alas2023-2024-759.md) | Nov 13, 2024 | | Linux | expat-debugsource amzn 2023 | 2.6.3-1.amzn2023.0.1 | [ALAS2023-2024-759](https://patchblox.com/security/data/fix/linux/alas2023-2024-759.md) | Nov 13, 2024 | | Linux | expat-devel RHEL 8 | 0:2.2.5-11.el8_9.1 | [RHSA-2024:1615](https://patchblox.com/security/data/fix/linux/rhsa-2024-1615.md) | Apr 2, 2024 | | Linux | expat-devel RHEL 9 | 0:2.5.0-1.el9_3.1 | [RHSA-2024:1530](https://patchblox.com/security/data/fix/linux/rhsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat-devel almalinux 8 | 2.2.5-11.el8_9.1 | [ALSA-2024:1615](https://patchblox.com/security/data/fix/linux/alsa-2024-1615.md) | Apr 2, 2024 | | Linux | expat-devel almalinux 9 | 2.5.0-1.el9_3.1 | [ALSA-2024:1530](https://patchblox.com/security/data/fix/linux/alsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat-devel amzn 2023 | 2.6.3-1.amzn2023.0.1 | [ALAS2023-2024-759](https://patchblox.com/security/data/fix/linux/alas2023-2024-759.md) | Nov 13, 2024 | | Linux | expat-devel ol 8 | 0:2.2.5-11.0.1.el8_9.1 | [ELSA-2024-1615](https://patchblox.com/security/data/fix/linux/elsa-2024-1615.md) | Apr 3, 2024 | | Linux | expat-devel ol 9 | 0:2.5.0-1.el9_3.1 | [ELSA-2024-1530](https://patchblox.com/security/data/fix/linux/elsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat-static amzn 2023 | 2.6.3-1.amzn2023.0.1 | [ALAS2023-2024-759](https://patchblox.com/security/data/fix/linux/alas2023-2024-759.md) | Nov 13, 2024 | | Linux | libexpat1 Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.3 | [libexpat1 2.4.7-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libexpat1-2.4.7-1ubuntu0.3.md) | Mar 9, 2024 | | Linux | libexpat1 Ubuntu 24.04.5 LTS (noble) | 2.6.0-1 | [libexpat1 2.6.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libexpat1-2.6.0-1.md) | Feb 4, 2024 | | Linux | libexpat1 Ubuntu 24.10 (oracular) | 2.6.0-1 | [libexpat1 2.6.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libexpat1-2.6.0-1.md) | Jan 16, 2026 | | Linux | libexpat1 Ubuntu 25.04 (plucky) | 2.6.0-1 | [libexpat1 2.6.0-1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libexpat1-2.6.0-1.md) | Jan 16, 2026 | | Linux | python opensuse-leap 15.6 | 2.7.18-150000.65.1 | [SUSE-SU-2024:1862-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1862-1.md) | May 30, 2024 | | Linux | python sles 15.6 | 2.7.18-150000.65.1 | [SUSE-SU-2024:1862-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1862-1.md) | May 30, 2024 | | Linux | python-base opensuse-leap 15.6 | 2.7.18-150000.65.1 | [SUSE-SU-2024:1862-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1862-1.md) | May 30, 2024 | | Linux | python-base sles 15.6 | 2.7.18-150000.65.1 | [SUSE-SU-2024:1862-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1862-1.md) | May 30, 2024 | | Linux | python-doc opensuse-leap 15.6 | 2.7.18-150000.65.1 | [SUSE-SU-2024:1862-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1862-1.md) | May 30, 2024 | | Linux | python3 opensuse-leap 15.6 | 3.6.15-150300.10.65.2 | [SUSE-SU-2024:2479-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-2479-1.md) | Jul 15, 2024 | | Linux | python3 sles 15.6 | 3.6.15-150300.10.65.2 | [SUSE-SU-2024:2479-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-2479-1.md) | Jul 15, 2024 | | Linux | python3-core opensuse-leap 15.6 | 3.6.15-150300.10.65.1 | [SUSE-SU-2024:2479-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-2479-1.md) | Jul 15, 2024 | | Linux | python3-core sles 15.6 | 3.6.15-150300.10.65.1 | [SUSE-SU-2024:2479-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-2479-1.md) | Jul 15, 2024 | | Linux | python3-documentation opensuse-leap 15.6 | 3.6.15-150300.10.65.1 | [SUSE-SU-2024:2479-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-2479-1.md) | Jul 15, 2024 | | Linux | python310 opensuse-leap 15.6 | 3.10.14-150400.4.48.1 | [SUSE-SU-2024:1698-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1698-1.md) | May 20, 2024 | | Linux | python310-core opensuse-leap 15.6 | 3.10.14-150400.4.48.1 | [SUSE-SU-2024:1698-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1698-1.md) | May 20, 2024 | | Linux | python310-documentation opensuse-leap 15.6 | 3.10.14-150400.4.48.1 | [SUSE-SU-2024:1698-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-1698-1.md) | May 20, 2024 | | Linux | xmlrpc-c RHEL 8 | 0:1.51.0-9.el8_10 | [RHSA-2024:4259](https://patchblox.com/security/data/fix/linux/rhsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c almalinux 8 | 1.51.0-9.el8_10 | [ALSA-2024:4259](https://patchblox.com/security/data/fix/linux/alsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c ol 8 | 0:1.51.0-9.el8_10 | [ELSA-2024-4259](https://patchblox.com/security/data/fix/linux/elsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c rocky 8 | 0:1.51.0-9.el8_10 | [RLSA-2024:4259](https://patchblox.com/security/data/fix/linux/rlsa-2024-4259.md) | May 7, 2025 | | Linux | xmlrpc-c-apps amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-apps-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-c++ RHEL 8 | 0:1.51.0-9.el8_10 | [RHSA-2024:4259](https://patchblox.com/security/data/fix/linux/rhsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-c++ almalinux 8 | 1.51.0-9.el8_10 | [ALSA-2024:4259](https://patchblox.com/security/data/fix/linux/alsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-c++ amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-c++ ol 8 | 0:1.51.0-9.el8_10 | [ELSA-2024-4259](https://patchblox.com/security/data/fix/linux/elsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-c++-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client RHEL 8 | 0:1.51.0-9.el8_10 | [RHSA-2024:4259](https://patchblox.com/security/data/fix/linux/rhsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-client almalinux 8 | 1.51.0-9.el8_10 | [ALSA-2024:4259](https://patchblox.com/security/data/fix/linux/alsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-client amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client ol 8 | 0:1.51.0-9.el8_10 | [ELSA-2024-4259](https://patchblox.com/security/data/fix/linux/elsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-client++ RHEL 8 | 0:1.51.0-9.el8_10 | [RHSA-2024:4259](https://patchblox.com/security/data/fix/linux/rhsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-client++ almalinux 8 | 1.51.0-9.el8_10 | [ALSA-2024:4259](https://patchblox.com/security/data/fix/linux/alsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-client++ amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client++ ol 8 | 0:1.51.0-9.el8_10 | [ELSA-2024-4259](https://patchblox.com/security/data/fix/linux/elsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-client++-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-debugsource amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-devel RHEL 8 | 0:1.51.0-9.el8_10 | [RHSA-2024:4259](https://patchblox.com/security/data/fix/linux/rhsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-devel almalinux 8 | 1.51.0-9.el8_10 | [ALSA-2024:4259](https://patchblox.com/security/data/fix/linux/alsa-2024-4259.md) | Jul 2, 2024 | | Linux | xmlrpc-c-devel amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-devel ol 8 | 0:1.51.0-9.el8_10 | [ELSA-2024-4259](https://patchblox.com/security/data/fix/linux/elsa-2024-4259.md) | Jul 2, 2024 | --- Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.