Loading vulnerability…
Large-token parsing denial of service in libexpat
CVE-2023-52425 is a resource-consumption vulnerability in Expat (libexpat) through version 2.5.0. When an XML token is sufficiently large to require multiple buffer fills, the parser repeatedly reparses the incomplete token from its beginning. This redundant processing causes excessive resource consumption and can deny service to applications processing attacker-controlled XML. Upstream libexpat 2.6.0 addresses the issue with reparse-deferral functionality.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Crafted XML input can exhaust processing resources, causing substantial slowdowns or denial of service in applications using vulnerable libexpat versions. The assessed availability impact is high, with no assessed confidentiality or integrity impact. Remote exploitation is possible when an application exposes affected XML parsing to network-supplied input.
If you can’t patch tonight, do this now.
No generally suitable mitigation is identified. Red Hat states that available mitigations are either unavailable or do not meet its criteria for ease of deployment, broad applicability, or stability. Installing the applicable security update is the recommended response.
Patch, then assume compromise.
Upgrade to libexpat 2.6.0 or a later supported release, or install the applicable vendor package containing a backported fix. Update applications and container images that bundle libexpat rather than relying solely on the system library update. Restart applications using the library after installation. Evaluate vendor package release information because backported fixes may retain an upstream version number below 2.6.0.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.