CVE-2023-52425
expat: parsing large tokens can trigger a denial of service
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
libexpat hasta 2.5.0 permite una denegación de servicio (consumo de recursos) porque se requieren muchos análisis completos en el caso de un token grande para el cual se necesitan múltiples rellenos de búfer.
A flaw was found in Expat (libexpat). When parsing a large token that requires multiple buffer fills to complete, Expat has to re-parse the token from start numerous times. This process may trigger excessive resource consumption, leading to a denial of service.
It was discovered that Expat could be made to consume large amounts of resources. If a user or automated system were tricked into processing specially crafted input, an attacker could possibly use this issue to cause a denial of service.
CVSS Scores
SSVC
- Decision:Attend
Timeline
- 2024-02-04 CVE Reserved
- 2024-02-04 CVE Published
- 2024-08-26 CVE Updated
- 2024-08-26 First Exploit
- 2025-05-16 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (8)
| URL | Date | SRC |
|---|---|---|
| https://github.com/libexpat/libexpat/pull/789 | 2024-08-26 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Libexpat Project Search vendor "Libexpat Project" | Libexpat Search vendor "Libexpat Project" for product "Libexpat" | <= 2.5.0 Search vendor "Libexpat Project" for product "Libexpat" and version " <= 2.5.0" | - |
Affected
| ||||||