CVE-2023-52425

HIGH7.5EPSS 1.6%

expat - security update

Published: 2/4/2024Modified: 12/3/2025

Also known as:ALPINE-CVE-2023-52425

Description

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

Affected packages (5)

Alpine/expatfrom 0, < 2.6.0-r0
Debian/expatfrom 0, < 2.2.10-2+deb11u6
Debian/expatfrom 0, < 2.2.6-2+deb10u7
Debian/expatfrom 0, < 2.2.10-2+deb11u6
Debian/libxmltokfrom 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (2)

ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2023-52425
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2023-52425