# CVE-2024-45491: expat: An issue was discovered in libexpat before 2.6.3

CVE-2024-45491 is fixed in 14 products on 1 platform, first by expat 2.2.5-3ubuntu0.9+esm1, released August 29, 2024. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2024-45491
- Priority: High
- CVSS: 9.8 (Medium)
- EPSS: 0.0113
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 29, 2024

## Description

An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | expat Debian 12.15 (bookworm) | 2.5.0-1+deb12u1 | [DEBIAN-CVE-2024-45491](https://patchblox.com/security/data/fix/linux/debian-cve-2024-45491.md) | Aug 30, 2024 |
| Linux | expat Debian 13.5 (trixie) | 2.6.2-2 | [DEBIAN-CVE-2024-45491](https://patchblox.com/security/data/fix/linux/debian-cve-2024-45491.md) | Aug 30, 2024 |
| Linux | expat Debian 14 | 2.6.2-2 | [DEBIAN-CVE-2024-45491](https://patchblox.com/security/data/fix/linux/debian-cve-2024-45491.md) | Aug 30, 2024 |
| Linux | expat RHEL 8 | 0:2.2.5-15.el8_10 | [RHSA-2024:6989](https://patchblox.com/security/data/fix/linux/rhsa-2024-6989.md) | Sep 24, 2024 |
| Linux | expat RHEL 9 | 0:2.5.0-2.el9_4.1 | [RHSA-2024:6754](https://patchblox.com/security/data/fix/linux/rhsa-2024-6754.md) | Sep 18, 2024 |
| Linux | expat Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.9+esm1 | [expat 2.2.5-3ubuntu0.9+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-expat-2.2.5-3ubuntu0.9-esm1.md) | Aug 29, 2024 |
| Linux | expat Ubuntu 20.04 LTS (focal) | 2.2.9-1ubuntu0.7 | [expat 2.2.9-1ubuntu0.7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-expat-2.2.9-1ubuntu0.7.md) | Aug 29, 2024 |
| Linux | expat Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.4 | [expat 2.4.7-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-expat-2.4.7-1ubuntu0.4.md) | Aug 29, 2024 |
| Linux | expat Ubuntu 24.04.5 LTS (noble) | 2.6.1-2ubuntu0.1 | [expat 2.6.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-expat-2.6.1-2ubuntu0.1.md) | Aug 29, 2024 |
| Linux | expat almalinux 8 | 2.2.5-15.el8_10 | [ALSA-2024:6989](https://patchblox.com/security/data/fix/linux/alsa-2024-6989.md) | Sep 24, 2024 |
| Linux | expat almalinux 9 | 2.5.0-2.el9_4.1 | [ALSA-2024:6754](https://patchblox.com/security/data/fix/linux/alsa-2024-6754.md) | Sep 18, 2024 |
| Linux | expat ol 8 | 0:2.2.5-15.0.1.el8_10 | [ELSA-2024-6989](https://patchblox.com/security/data/fix/linux/elsa-2024-6989.md) | Sep 24, 2024 |
| Linux | expat ol 9 | 0:2.5.0-2.el9_4.1 | [ELSA-2024-6754](https://patchblox.com/security/data/fix/linux/elsa-2024-6754.md) | Sep 18, 2024 |
| Linux | expat opensuse-leap 15.6 | 2.4.4-150400.3.22.1 | [SUSE-SU-2024:3216-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3216-1.md) | Sep 12, 2024 |
| Linux | expat rocky 8 | 0:2.2.5-15.el8_10 | [RLSA-2024:6989](https://patchblox.com/security/data/fix/linux/rlsa-2024-6989.md) | Sep 30, 2024 |
| Linux | expat rocky 9 | 0:2.5.0-2.el9_4.1 | [RLSA-2024:6754](https://patchblox.com/security/data/fix/linux/rlsa-2024-6754.md) | Sep 30, 2024 |
| Linux | expat sles 15.6 | 2.4.4-150400.3.22.1 | [SUSE-SU-2024:3216-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3216-1.md) | Sep 12, 2024 |
| Linux | expat-devel RHEL 8 | 0:2.2.5-15.el8_10 | [RHSA-2024:6989](https://patchblox.com/security/data/fix/linux/rhsa-2024-6989.md) | Sep 24, 2024 |
| Linux | expat-devel RHEL 9 | 0:2.5.0-2.el9_4.1 | [RHSA-2024:6754](https://patchblox.com/security/data/fix/linux/rhsa-2024-6754.md) | Sep 18, 2024 |
| Linux | expat-devel almalinux 8 | 2.2.5-15.el8_10 | [ALSA-2024:6989](https://patchblox.com/security/data/fix/linux/alsa-2024-6989.md) | Sep 24, 2024 |
| Linux | expat-devel almalinux 9 | 2.5.0-2.el9_4.1 | [ALSA-2024:6754](https://patchblox.com/security/data/fix/linux/alsa-2024-6754.md) | Sep 18, 2024 |
| Linux | expat-devel ol 8 | 0:2.2.5-15.0.1.el8_10 | [ELSA-2024-6989](https://patchblox.com/security/data/fix/linux/elsa-2024-6989.md) | Sep 24, 2024 |
| Linux | expat-devel ol 9 | 0:2.5.0-2.el9_4.1 | [ELSA-2024-6754](https://patchblox.com/security/data/fix/linux/elsa-2024-6754.md) | Sep 18, 2024 |
| Linux | libexpat1 Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.9+esm1 | [libexpat1 2.2.5-3ubuntu0.9+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libexpat1-2.2.5-3ubuntu0.9-esm1.md) | Aug 29, 2024 |
| Linux | libexpat1 Ubuntu 20.04 LTS (focal) | 2.2.9-1ubuntu0.7 | [libexpat1 2.2.9-1ubuntu0.7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libexpat1-2.2.9-1ubuntu0.7.md) | Aug 29, 2024 |
| Linux | libexpat1 Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.4 | [libexpat1 2.4.7-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libexpat1-2.4.7-1ubuntu0.4.md) | Aug 29, 2024 |
| Linux | libexpat1 Ubuntu 24.04.5 LTS (noble) | 2.6.1-2ubuntu0.1 | [libexpat1 2.6.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libexpat1-2.6.1-2ubuntu0.1.md) | Aug 29, 2024 |
| Linux | libxmltok1 Ubuntu 18.04.6 LTS (bionic) | 1.2-4ubuntu0.18.04.1~esm3 | [libxmltok1 1.2-4ubuntu0.18.04.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libxmltok1-1.2-4ubuntu0.18.04.1-esm3.md) | Aug 29, 2024 |
| Linux | libxmltok1 Ubuntu 20.04 LTS (focal) | 1.2-4ubuntu0.20.04.1~esm3 | [libxmltok1 1.2-4ubuntu0.20.04.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libxmltok1-1.2-4ubuntu0.20.04.1-esm3.md) | Aug 29, 2024 |
| Linux | libxmltok1 Ubuntu 22.04.1 LTS (jammy) | 1.2-4ubuntu0.22.04.1~esm3 | [libxmltok1 1.2-4ubuntu0.22.04.1~esm3](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libxmltok1-1.2-4ubuntu0.22.04.1-esm3.md) | Aug 29, 2024 |
| Linux | libxmltok1t64 Ubuntu 24.04.5 LTS (noble) | 1.2-4.1ubuntu2.24.0.4.1+esm1 | [libxmltok1t64 1.2-4.1ubuntu2.24.0.4.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libxmltok1t64-1.2-4.1ubuntu2.24.0.4.1-esm1.md) | Aug 29, 2024 |
| Linux | libxmltok1t64 Ubuntu 24.10 (oracular) | 1.2-4.1ubuntu3 | [libxmltok1t64 1.2-4.1ubuntu3](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libxmltok1t64-1.2-4.1ubuntu3.md) | Jan 16, 2026 |
| Linux | libxmltok1t64 Ubuntu 25.04 (plucky) | 1.2-4.1ubuntu3 | [libxmltok1t64 1.2-4.1ubuntu3](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libxmltok1t64-1.2-4.1ubuntu3.md) | Jan 16, 2026 |
| Linux | mozjs115 opensuse-leap 15.6 | 115.4.0-150600.3.3.1 | [SUSE-SU-2024:3538-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3538-1.md) | Oct 7, 2024 |
| Linux | mozjs115 sles 15.6 | 115.4.0-150600.3.3.1 | [SUSE-SU-2024:3538-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3538-1.md) | Oct 7, 2024 |
| Linux | mozjs52 opensuse-leap 15.6 | 52.6.0-150000.3.9.1 | [SUSE-SU-2025:4512-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4512-1.md) | Dec 23, 2025 |
| Linux | mozjs52 sles 15.7 | 52.6.0-150000.3.9.1 | [SUSE-SU-2025:4512-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4512-1.md) | Dec 23, 2025 |
| Linux | mozjs60 opensuse-leap 15.6 | 60.9.0-150200.6.8.1 | [SUSE-SU-2026:0044-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0044-1.md) | Jan 6, 2026 |
| Linux | mozjs60 sles 15.7 | 60.9.0-150200.6.8.1 | [SUSE-SU-2026:0044-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0044-1.md) | Jan 6, 2026 |
| Linux | mozjs78 opensuse-leap 15.6 | 78.15.0-150400.3.6.2 | [SUSE-SU-2024:3554-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3554-1.md) | Oct 9, 2024 |
| Linux | mozjs78 sles 15.6 | 78.15.0-150400.3.6.2 | [SUSE-SU-2024:3554-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3554-1.md) | Oct 9, 2024 |
| Linux | xmlrpc-c RHEL 8 | 0:1.51.0-10.el8_10 | [RHSA-2024:8859](https://patchblox.com/security/data/fix/linux/rhsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c almalinux 8 | 1.51.0-10.el8_10 | [ALSA-2024:8859](https://patchblox.com/security/data/fix/linux/alsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c ol 8 | 0:1.51.0-10.el8_10 | [ELSA-2024-8859](https://patchblox.com/security/data/fix/linux/elsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c rocky 8 | 0:1.51.0-10.el8_10 | [RLSA-2024:8859](https://patchblox.com/security/data/fix/linux/rlsa-2024-8859.md) | Nov 8, 2024 |
| Linux | xmlrpc-c-c++ RHEL 8 | 0:1.51.0-10.el8_10 | [RHSA-2024:8859](https://patchblox.com/security/data/fix/linux/rhsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-c++ almalinux 8 | 1.51.0-10.el8_10 | [ALSA-2024:8859](https://patchblox.com/security/data/fix/linux/alsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-c++ ol 8 | 0:1.51.0-10.el8_10 | [ELSA-2024-8859](https://patchblox.com/security/data/fix/linux/elsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-client RHEL 8 | 0:1.51.0-10.el8_10 | [RHSA-2024:8859](https://patchblox.com/security/data/fix/linux/rhsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-client almalinux 8 | 1.51.0-10.el8_10 | [ALSA-2024:8859](https://patchblox.com/security/data/fix/linux/alsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-client ol 8 | 0:1.51.0-10.el8_10 | [ELSA-2024-8859](https://patchblox.com/security/data/fix/linux/elsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-client++ RHEL 8 | 0:1.51.0-10.el8_10 | [RHSA-2024:8859](https://patchblox.com/security/data/fix/linux/rhsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-client++ almalinux 8 | 1.51.0-10.el8_10 | [ALSA-2024:8859](https://patchblox.com/security/data/fix/linux/alsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-client++ ol 8 | 0:1.51.0-10.el8_10 | [ELSA-2024-8859](https://patchblox.com/security/data/fix/linux/elsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-devel RHEL 8 | 0:1.51.0-10.el8_10 | [RHSA-2024:8859](https://patchblox.com/security/data/fix/linux/rhsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-devel almalinux 8 | 1.51.0-10.el8_10 | [ALSA-2024:8859](https://patchblox.com/security/data/fix/linux/alsa-2024-8859.md) | Nov 5, 2024 |
| Linux | xmlrpc-c-devel ol 8 | 0:1.51.0-10.el8_10 | [ELSA-2024-8859](https://patchblox.com/security/data/fix/linux/elsa-2024-8859.md) | Nov 5, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.