# CVE-2024-45492: expat: Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: Negative Length Parsing Vulnerability... CVE-2024-45492 is fixed in 7 products on 1 platform, first by expat 2.2.5-3ubuntu0.9+esm1, released August 29, 2024. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2024-45492 - Priority: High - CVSS: 9.8 (Moderate) - EPSS: 0.0139 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Aug 29, 2024 ## Description Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: Negative Length Parsing Vulnerability in libexpat (CVE-2024-45490) * libexpat: Integer Overflow or Wraparound (CVE-2024-45491) * libexpat: integer overflow (CVE-2024-45492) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | expat Debian 12.15 (bookworm) | 2.5.0-1+deb12u1 | [DEBIAN-CVE-2024-45492](https://patchblox.com/security/data/fix/linux/debian-cve-2024-45492.md) | Aug 30, 2024 | | Linux | expat Debian 13.5 (trixie) | 2.6.2-2 | [DEBIAN-CVE-2024-45492](https://patchblox.com/security/data/fix/linux/debian-cve-2024-45492.md) | Aug 30, 2024 | | Linux | expat Debian 14 | 2.6.2-2 | [DEBIAN-CVE-2024-45492](https://patchblox.com/security/data/fix/linux/debian-cve-2024-45492.md) | Aug 30, 2024 | | Linux | expat RHEL 8 | 0:2.2.5-15.el8_10 | [RHSA-2024:6989](https://patchblox.com/security/data/fix/linux/rhsa-2024-6989.md) | Sep 24, 2024 | | Linux | expat RHEL 9 | 0:2.5.0-2.el9_4.1 | [RHSA-2024:6754](https://patchblox.com/security/data/fix/linux/rhsa-2024-6754.md) | Sep 18, 2024 | | Linux | expat Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.9+esm1 | [expat 2.2.5-3ubuntu0.9+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-expat-2.2.5-3ubuntu0.9-esm1.md) | Aug 29, 2024 | | Linux | expat Ubuntu 20.04 LTS (focal) | 2.2.9-1ubuntu0.7 | [expat 2.2.9-1ubuntu0.7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-expat-2.2.9-1ubuntu0.7.md) | Aug 29, 2024 | | Linux | expat Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.4 | [expat 2.4.7-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-expat-2.4.7-1ubuntu0.4.md) | Aug 29, 2024 | | Linux | expat Ubuntu 24.04.5 LTS (noble) | 2.6.1-2ubuntu0.1 | [expat 2.6.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-expat-2.6.1-2ubuntu0.1.md) | Aug 29, 2024 | | Linux | expat almalinux 8 | 2.2.5-15.el8_10 | [ALSA-2024:6989](https://patchblox.com/security/data/fix/linux/alsa-2024-6989.md) | Sep 24, 2024 | | Linux | expat almalinux 9 | 2.5.0-2.el9_4.1 | [ALSA-2024:6754](https://patchblox.com/security/data/fix/linux/alsa-2024-6754.md) | Sep 18, 2024 | | Linux | expat ol 8 | 0:2.2.5-15.0.1.el8_10 | [ELSA-2024-6989](https://patchblox.com/security/data/fix/linux/elsa-2024-6989.md) | Sep 24, 2024 | | Linux | expat ol 9 | 0:2.5.0-2.el9_4.1 | [ELSA-2024-6754](https://patchblox.com/security/data/fix/linux/elsa-2024-6754.md) | Sep 18, 2024 | | Linux | expat opensuse-leap 15.6 | 2.4.4-150400.3.22.1 | [SUSE-SU-2024:3216-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3216-1.md) | Sep 12, 2024 | | Linux | expat rocky 8 | 0:2.2.5-15.el8_10 | [RLSA-2024:6989](https://patchblox.com/security/data/fix/linux/rlsa-2024-6989.md) | Sep 30, 2024 | | Linux | expat rocky 9 | 0:2.5.0-2.el9_4.1 | [RLSA-2024:6754](https://patchblox.com/security/data/fix/linux/rlsa-2024-6754.md) | Sep 30, 2024 | | Linux | expat sles 15.6 | 2.4.4-150400.3.22.1 | [SUSE-SU-2024:3216-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3216-1.md) | Sep 12, 2024 | | Linux | expat-devel RHEL 8 | 0:2.2.5-15.el8_10 | [RHSA-2024:6989](https://patchblox.com/security/data/fix/linux/rhsa-2024-6989.md) | Sep 24, 2024 | | Linux | expat-devel RHEL 9 | 0:2.5.0-2.el9_4.1 | [RHSA-2024:6754](https://patchblox.com/security/data/fix/linux/rhsa-2024-6754.md) | Sep 18, 2024 | | Linux | expat-devel almalinux 8 | 2.2.5-15.el8_10 | [ALSA-2024:6989](https://patchblox.com/security/data/fix/linux/alsa-2024-6989.md) | Sep 24, 2024 | | Linux | expat-devel almalinux 9 | 2.5.0-2.el9_4.1 | [ALSA-2024:6754](https://patchblox.com/security/data/fix/linux/alsa-2024-6754.md) | Sep 18, 2024 | | Linux | expat-devel ol 8 | 0:2.2.5-15.0.1.el8_10 | [ELSA-2024-6989](https://patchblox.com/security/data/fix/linux/elsa-2024-6989.md) | Sep 24, 2024 | | Linux | expat-devel ol 9 | 0:2.5.0-2.el9_4.1 | [ELSA-2024-6754](https://patchblox.com/security/data/fix/linux/elsa-2024-6754.md) | Sep 18, 2024 | | Linux | libexpat1 Ubuntu 18.04.6 LTS (bionic) | 2.2.5-3ubuntu0.9+esm1 | [libexpat1 2.2.5-3ubuntu0.9+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libexpat1-2.2.5-3ubuntu0.9-esm1.md) | Aug 29, 2024 | | Linux | libexpat1 Ubuntu 20.04 LTS (focal) | 2.2.9-1ubuntu0.7 | [libexpat1 2.2.9-1ubuntu0.7](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libexpat1-2.2.9-1ubuntu0.7.md) | Aug 29, 2024 | | Linux | libexpat1 Ubuntu 22.04.1 LTS (jammy) | 2.4.7-1ubuntu0.4 | [libexpat1 2.4.7-1ubuntu0.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libexpat1-2.4.7-1ubuntu0.4.md) | Aug 29, 2024 | | Linux | libexpat1 Ubuntu 24.04.5 LTS (noble) | 2.6.1-2ubuntu0.1 | [libexpat1 2.6.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libexpat1-2.6.1-2ubuntu0.1.md) | Aug 29, 2024 | | Linux | mozjs115 opensuse-leap 15.6 | 115.4.0-150600.3.3.1 | [SUSE-SU-2024:3538-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3538-1.md) | Oct 7, 2024 | | Linux | mozjs115 sles 15.6 | 115.4.0-150600.3.3.1 | [SUSE-SU-2024:3538-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3538-1.md) | Oct 7, 2024 | | Linux | mozjs52 opensuse-leap 15.6 | 52.6.0-150000.3.9.1 | [SUSE-SU-2025:4512-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4512-1.md) | Dec 23, 2025 | | Linux | mozjs52 sles 15.7 | 52.6.0-150000.3.9.1 | [SUSE-SU-2025:4512-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-4512-1.md) | Dec 23, 2025 | | Linux | mozjs60 opensuse-leap 15.6 | 60.9.0-150200.6.8.1 | [SUSE-SU-2026:0044-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0044-1.md) | Jan 6, 2026 | | Linux | mozjs60 sles 15.7 | 60.9.0-150200.6.8.1 | [SUSE-SU-2026:0044-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0044-1.md) | Jan 6, 2026 | | Linux | mozjs78 opensuse-leap 15.6 | 78.15.0-150400.3.6.2 | [SUSE-SU-2024:3554-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3554-1.md) | Oct 9, 2024 | | Linux | mozjs78 sles 15.6 | 78.15.0-150400.3.6.2 | [SUSE-SU-2024:3554-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3554-1.md) | Oct 9, 2024 | --- Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.