CVE-2023-52426

Summary

CVE	CVE-2023-52426
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2024-02-04 20:15:46 UTC
Updated	2026-10-15 01:17:13 UTC
Description	libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time.

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-776 | n/a | CWE-776 CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	ADP	DECLARED	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	134c704f-9b21-4f2e-91b3-4a467353bcc0	Secondary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Type	Vendor	Product	Version	Update	Edition	Language
Application	Libexpat Project	Libexpat	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified
ADP	Siemens	SINEC NMS	affected V3.0 custom	Not specified
ADP	Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	affected V3.1.0 V3.1.5 custom	Not specified

Reference	Source	Link	Tags
cert-portal.siemens.com/productcert/html/ssa-398330.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
lists.fedoraproject.org/archives/list/[email protected]/messag...	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
security.netapp.com/advisory/ntap-20240307-0005	af854a3a-2127-422b-91ae-364da2661108	security.netapp.com
Fix issues for compilation with XML_DTD undefined by hartwork · Pull Request #777 · libexpat/libexpat · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Vendor Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mess...	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
cert-portal.siemens.com/productcert/html/ssa-784301.html	0b142b55-0307-4c5a-b3c9-f314f3fb7c5e	cert-portal.siemens.com
CWE - CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (4.13)	af854a3a-2127-422b-91ae-364da2661108	cwe.mitre.org	Technical Description
lib\|xmlwf\|cmake: Extend scope of billion laughs attack protection · libexpat/libexpat@0f075ec · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Patch, Vendor Advisory
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mess...	af854a3a-2127-422b-91ae-364da2661108	lists.fedoraproject.org
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

284934 Fedora Security Update for mingw (FEDORA-2024-b8656bc059)
284973 Fedora Security Update for mingw (FEDORA-2024-fbe1f0c1aa)
330169 IBM AIX Multiple Vulnerabilities (python_advisory8)
357255 Amazon Linux Security Advisory for expat : ALAS2023-2024-524
510720 Alpine Linux Security Update for expat
6140424 AWS Bottlerocket Security Update for libexpat (GHSA-vc92-wc47-6qmx)
908038 Common Base Linux Mariner (CBL-Mariner) Security Update for expat (34208)