# CVE-2024-28757: expat: Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat in Expat allows attackers to tr... CVE-2024-28757 is fixed in 18 products on 1 platform, first by expat 2.4.7-1ubuntu0.3, released March 9, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2024-28757 - Priority: High - CVSS: 7.5 (Important) - EPSS: 0.0201 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 9, 2024 ## Description Expat is a C library for parsing XML documents. Security Fix(es): * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | expat Debian 12.15 (bookworm) | 2.5.0-1+deb12u4 | [DEBIAN-CVE-2024-28757](https://patchblox.com/security/data/fix/linux/debian-cve-2024-28757.md) | Mar 10, 2024 | | Linux | expat Debian 13.5 (trixie) | 2.6.1-2 | [DEBIAN-CVE-2024-28757](https://patchblox.com/security/data/fix/linux/debian-cve-2024-28757.md) | Mar 10, 2024 | | Linux | expat Debian 14 | 2.6.1-2 | [DEBIAN-CVE-2024-28757](https://patchblox.com/security/data/fix/linux/debian-cve-2024-28757.md) | Mar 10, 2024 | | Linux | expat RHEL 8 | 0:2.5.0-1.el8_10 | [RHSA-2025:21776](https://patchblox.com/security/data/fix/linux/rhsa-2025-21776.md) | Nov 19, 2025 | | Linux | expat RHEL 9 | 0:2.5.0-1.el9_3.1 | [RHSA-2024:1530](https://patchblox.com/security/data/fix/linux/rhsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.3 | [expat 2.4.7-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-expat-2.4.7-1ubuntu0.3.md) | Mar 9, 2024 | | Linux | expat almalinux 8 | 2.5.0-1.el8_10 | [ALSA-2025:21776](https://patchblox.com/security/data/fix/linux/alsa-2025-21776.md) | Nov 19, 2025 | | Linux | expat almalinux 9 | 2.5.0-1.el9_3.1 | [ALSA-2024:1530](https://patchblox.com/security/data/fix/linux/alsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat amzn 2023 | 2.5.0-1.amzn2023.0.4 | [ALAS2023-2024-576](https://patchblox.com/security/data/fix/linux/alas2023-2024-576.md) | Mar 27, 2024 | | Linux | expat ol 9 | 0:2.5.0-1.el9_3.1 | [ELSA-2024-1530](https://patchblox.com/security/data/fix/linux/elsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat-debuginfo amzn 2023 | 2.5.0-1.amzn2023.0.4 | [ALAS2023-2024-576](https://patchblox.com/security/data/fix/linux/alas2023-2024-576.md) | Mar 27, 2024 | | Linux | expat-debugsource amzn 2023 | 2.5.0-1.amzn2023.0.4 | [ALAS2023-2024-576](https://patchblox.com/security/data/fix/linux/alas2023-2024-576.md) | Mar 27, 2024 | | Linux | expat-devel RHEL 8 | 0:2.5.0-1.el8_10 | [RHSA-2025:21776](https://patchblox.com/security/data/fix/linux/rhsa-2025-21776.md) | Nov 19, 2025 | | Linux | expat-devel RHEL 9 | 0:2.5.0-1.el9_3.1 | [RHSA-2024:1530](https://patchblox.com/security/data/fix/linux/rhsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat-devel almalinux 8 | 2.5.0-1.el8_10 | [ALSA-2025:21776](https://patchblox.com/security/data/fix/linux/alsa-2025-21776.md) | Nov 19, 2025 | | Linux | expat-devel almalinux 9 | 2.5.0-1.el9_3.1 | [ALSA-2024:1530](https://patchblox.com/security/data/fix/linux/alsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat-devel amzn 2023 | 2.5.0-1.amzn2023.0.4 | [ALAS2023-2024-576](https://patchblox.com/security/data/fix/linux/alas2023-2024-576.md) | Mar 27, 2024 | | Linux | expat-devel ol 9 | 0:2.5.0-1.el9_3.1 | [ELSA-2024-1530](https://patchblox.com/security/data/fix/linux/elsa-2024-1530.md) | Mar 26, 2024 | | Linux | expat-static amzn 2023 | 2.5.0-1.amzn2023.0.4 | [ALAS2023-2024-576](https://patchblox.com/security/data/fix/linux/alas2023-2024-576.md) | Mar 27, 2024 | | Linux | libexpat1 Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.3 | [libexpat1 2.4.7-1ubuntu0.3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libexpat1-2.4.7-1ubuntu0.3.md) | Mar 9, 2024 | | Linux | xmlrpc-c amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-apps amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-apps-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-c++ amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-c++-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client++ amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client++-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-client-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-debuginfo amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-debugsource amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | | Linux | xmlrpc-c-devel amzn 2023 | 1.51.08-2.amzn2023.0.2 | [ALAS2023-2025-1229](https://patchblox.com/security/data/fix/linux/alas2023-2025-1229.md) | Oct 27, 2025 | --- Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.