Libexpat: Denial of Service vulnerability
An unpatched vulnerability in the expat XML parsing library allows a remote, unauthenticated attacker to cause a Denial of Service condition.
Triage facts
Revision 1- Applicability
- expat
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Oct 23, 15:04 UTC
- Source quality
- A1Roughly even chance
A vulnerability has been identified in the expat XML parsing library that can be exploited by a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition. As of this advisory, no patch is available to address this issue. Organizations using software that bundles or links against the expat library should monitor vendor security bulletins for updates.
Impact
Successful exploitation allows a remote attacker to crash the affected application or service, resulting in a Denial of Service.
Threat Hunt
Identify applications utilizing the expat library
Data: Software Bill of Materials (SBOM), Dependency scanning reports, Loaded module telemetry (ImageLoad)
Mitigations
Monitor vendor security advisories for an upstream patch for libexpat and plan for deployment upon release
expat