CVE-2023-52425

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2024/03/20/5
https://github.com/libexpat/libexpat/pull/789	Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/
https://security.netapp.com/advisory/ntap-20240614-0003/
http://www.openwall.com/lists/oss-security/2024/03/20/5
https://github.com/libexpat/libexpat/pull/789	Exploit Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/
https://lists.fedoraproject.org/archives/list/[email protected]/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
https://security.netapp.com/advisory/ntap-20240614-0003/

Configurations

Configuration 1 (hide)

cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*

History

04 Nov 2025, 19:16

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html - () https://lists.fedoraproject.org/archives/list/[email protected]/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/ -

Information

Published : 2024-02-04 20:15

Updated : 2025-11-04 19:16

NVD link : CVE-2023-52425

Mitre link : CVE-2023-52425

CVE.ORG link : CVE-2023-52425

JSON object : View

Products Affected

libexpat_project

libexpat

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-52425", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-02-04T20:15:46.063", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/03/20/5", "source": "[email protected]"}, {"url": "https://github.com/libexpat/libexpat/pull/789", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html", "source": "[email protected]"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/", "source": "[email protected]"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/", "source": "[email protected]"}, {"url": "https://security.netapp.com/advisory/ntap-20240614-0003/", "source": "[email protected]"}, {"url": "http://www.openwall.com/lists/oss-security/2024/03/20/5", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/libexpat/libexpat/pull/789", "tags": ["Exploit", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/04/msg00006.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/09/msg00036.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.fedoraproject.org/archives/list/[email protected]/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.netapp.com/advisory/ntap-20240614-0003/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-400"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed."}, {"lang": "es", "value": "libexpat hasta 2.5.0 permite una denegaci\u00f3n de servicio (consumo de recursos) porque se requieren muchos an\u00e1lisis completos en el caso de un token grande para el cual se necesitan m\u00faltiples rellenos de b\u00fafer."}], "lastModified": "2025-11-04T19:16:22.740", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:libexpat_project:libexpat:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C50909D-8A18-484B-A7DB-7EF4CA67C2CB", "versionEndIncluding": "2.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}