RHSA-2025:22785HighCVSS 9.8

Red Hat Security Advisory: expat security update

Published
December 4, 2025
Last Modified
July 3, 2026

🔗 CVE IDs covered (16)

📋 Description

CVE-2013-0340 — expat: internal entity expansion CVE-2021-45960 — expat: Large number of prefixed XML attributes on a single tag can crash libexpat CVE-2021-46143 — expat: Integer overflow in doProlog in xmlparse.c CVE-2022-22822 — expat: Integer overflow in addBinding in xmlparse.c CVE-2022-22823 — expat: Integer overflow in build_model in xmlparse.c CVE-2022-22824 — expat: Integer overflow in defineAttribute in xmlparse.c CVE-2022-22825 — expat: Integer overflow in lookup in xmlparse.c CVE-2022-22826 — expat: Integer overflow in nextScaffoldPart in xmlparse.c CVE-2022-22827 — expat: Integer overflow in storeAtts in xmlparse.c CVE-2022-23990 — expat: integer overflow in the doProlog function CVE-2022-25313 — expat: Stack exhaustion in doctype parsing CVE-2022-25314 — expat: Integer overflow in copyString() CVE-2022-43680 — expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate CVE-2023-52425 — expat: parsing large tokens can trigger a denial of service CVE-2024-8176 — libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat CVE-2025-59375 — firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

🔗 References (19)