WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Product libexpat✕
Overview 68 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
68matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 5 7.4% Not applicable 63 92.6% Withdrawn CVE 0 0.0%
Critical 11 16.2% High 28 41.2% Medium 28 41.2% Low 1 1.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 68 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 5 7.4% Forecast only 0 0.0% No public exploit 63 92.6%
split by peak 27 / year
Not applicable: 63Outside Waratek scope: 5 Low: 1Medium: 28High: 28Critical: 11 not blocked: 68 No public exploit: 63Proof of concept only: 5
20092 Not applicable2 Medium2 not blocked2 No public exploit2 20100 20110 20123 Not applicable3 Medium3 not blocked3 No public exploit3 20130 20141 Not applicable1 Medium1 not blocked1 No public exploit1 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20164 Not applicable4 Critical1 High2 Medium1 not blocked4 No public exploit4 20172 Not applicable2 High2 not blocked2 No public exploit2 20180 20192 Not applicable2 High2 not blocked2 No public exploit2 20200 20210 202217 Outside Waratek scope4 Not applicable13 Critical7 High9 Medium1 not blocked17 Proof of concept only3 No public exploit14 20230 20247 Outside Waratek scope1 Not applicable6 Critical3 High2 Medium2 not blocked7 Proof of concept only1 No public exploit6 20252 Not applicable2 High1 Medium1 not blocked2 No public exploit2 202627 Not applicable27 High10 Medium16 Low1 not blocked27 Proof of concept only1 No public exploit26
201020122014201620182020202220242026
68 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-118370 High 2026-10-28 Not applicable No public exploit libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory.
CVE-2026-117610 High 2026-10-28 Not applicable No public exploit libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application.
CVE-2026-115506 High 2026-10-22 Not applicable Proof of concept only libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse.
CVE-2026-113351 High 2026-10-20 Not applicable No public exploit libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.
CVE-2026-76957 High 2026-08-20 Not applicable No public exploit libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur. NOTE: this is similar to CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412.
CVE-2026-76956 High 2026-08-20 Not applicable No public exploit In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, causing a denial of service via crafted XML content.
CVE-2026-66046 High 2026-08-18 Not applicable No public exploit Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options.
CVE-2026-56412 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219.
CVE-2026-56411 Medium 2026-06-21 Not applicable No public exploit xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations.
CVE-2026-56410 Medium 2026-06-21 Not applicable No public exploit xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId.
CVE-2026-56409 Medium 2026-06-21 Not applicable No public exploit xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used.
CVE-2026-56408 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in copyString.
CVE-2026-56407 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen.
CVE-2026-56406 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse.
CVE-2026-56405 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in getAttributeId.
CVE-2026-56404 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in addBinding.
CVE-2026-56403 Medium 2026-06-21 Not applicable No public exploit libexpat before 2.8.2 has an integer overflow in storeAtts.
CVE-2026-56132 Medium 2026-06-19 Not applicable No public exploit In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers.
CVE-2026-56131 Medium 2026-06-19 Not applicable No public exploit libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation).
CVE-2026-50219 Medium 2026-06-04 Not applicable No public exploit libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur,
CVE-2026-45186 High 2026-05-10 Not applicable No public exploit In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
CVE-2026-41080 High 2026-04-16 Not applicable No public exploit libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.
CVE-2026-32778 Medium 2026-03-16 Not applicable No public exploit libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition.
CVE-2026-32777 Medium 2026-03-16 Not applicable No public exploit libexpat before 2.7.5 allows an infinite loop while parsing DTD content.
CVE-2026-32776 Medium 2026-03-16 Not applicable No public exploit libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content.
CVE-2026-25210 High 2026-01-30 Not applicable No public exploit In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
CVE-2026-24515 Low 2026-01-23 Not applicable No public exploit In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.
CVE-2025-66382 Medium 2025-11-28 Not applicable No public exploit In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVE-2025-59375 High 2025-09-15 Not applicable No public exploit libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing.
CVE-2024-50602 Medium 2024-10-27 Outside Waratek scope Proof of concept only An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.
CVE-2024-45492 Critical 2024-08-30 Not applicable No public exploit An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX).
CVE-2024-45491 Critical 2024-08-30 Not applicable No public exploit An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX).
CVE-2024-45490 Critical 2024-08-30 Not applicable No public exploit An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
CVE-2024-28757 High 2024-03-10 Not applicable No public exploit libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
CVE-2023-52426 Medium 2024-02-04 Not applicable No public exploit libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.
CVE-2023-52425 High 2024-02-04 Not applicable No public exploit libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
CVE-2022-43680 High 2022-10-24 Not applicable No public exploit In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
CVE-2022-40674 High 2022-09-14 Not applicable No public exploit libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c.
CVE-2022-25315 Critical 2022-02-18 Not applicable Proof of concept only In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
CVE-2022-25314 High 2022-02-18 Not applicable No public exploit In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString.
CVE-2022-25313 Medium 2022-02-18 Not applicable No public exploit In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element.
CVE-2022-25236 Critical 2022-02-16 Not applicable No public exploit xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
CVE-2022-25235 Critical 2022-02-16 Not applicable No public exploit xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
CVE-2022-23990 High 2022-01-26 Outside Waratek scope No public exploit Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
CVE-2022-23852 Critical 2022-01-24 Outside Waratek scope No public exploit Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
CVE-2022-22827 High 2022-01-10 Not applicable No public exploit storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22826 High 2022-01-10 Not applicable No public exploit nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22825 High 2022-01-10 Not applicable No public exploit lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22824 Critical 2022-01-10 Not applicable No public exploit defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22823 Critical 2022-01-10 Not applicable No public exploit build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22822 Critical 2022-01-10 Not applicable No public exploit addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2021-46143 High 2022-01-06 Outside Waratek scope Proof of concept only In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
CVE-2021-45960 High 2022-01-01 Outside Waratek scope Proof of concept only In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
CVE-2019-15903 High 2019-09-04 Not applicable No public exploit In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.
CVE-2018-20843 High 2019-06-24 Not applicable No public exploit In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).
CVE-2017-11742 High 2017-07-30 Not applicable No public exploit The writeRandomBytes_RtlGenRandom function in xmlparse.c in libexpat in Expat 2.2.1 and 2.2.2 on Windows allows local users to gain privileges via a Trojan horse ADVAPI32.DLL in the current working directory because of an untrusted search path, aka DLL hijacking.
CVE-2017-9233 High 2017-07-25 Not applicable No public exploit XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.
CVE-2016-4472 High 2016-06-30 Not applicable No public exploit The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.
CVE-2016-5300 High 2016-06-16 Not applicable No public exploit The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted identifiers in an XML document. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0876.
CVE-2012-6702 Medium 2016-06-16 Not applicable No public exploit Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.
CVE-2016-0718 Critical 2016-05-26 Not applicable No public exploit Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.
CVE-2015-1283 Medium 2015-07-23 Not applicable No public exploit Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
CVE-2013-0340 Medium 2014-01-21 Not applicable No public exploit expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
CVE-2012-1148 Medium 2012-07-03 Not applicable No public exploit Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.
CVE-2012-1147 Medium 2012-07-03 Not applicable No public exploit readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files.
CVE-2012-0876 Medium 2012-07-03 Not applicable No public exploit The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
CVE-2009-3560 Medium 2009-12-04 Not applicable No public exploit The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.
CVE-2009-3720 Medium 2009-11-03 Not applicable No public exploit The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.