The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictabl

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• canonical ubuntu linux10.04
• canonical ubuntu linux11.04
• canonical ubuntu linux11.10
• canonical ubuntu linux12.04
• canonical ubuntu linux8.04
• debian debian linux6.0
• debian debian linux7.0
• libexpat project libexpatbefore 2.1.0
• oracle solaris11.3
• python python3.1.0 and later · before 3.1.5
• python python2.7.0 and later · before 2.7.3
• python python2.6.0 and later · before 2.6.8
• python python3.2.0 and later · before 3.2.3
• redhat enterprise linux desktop5.0
• redhat enterprise linux desktop6.0
• redhat enterprise linux eus6.2
• redhat enterprise linux server5.0
• redhat enterprise linux server6.0
• redhat enterprise linux server aus6.2
• redhat enterprise linux workstation5.0

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2022-25236xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.
  50Plan
• CVE-2022-25315In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames.
  40Plan
• CVE-2022-25235xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val
  40Plan
• CVE-2022-23852Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES.
  40Plan
• CVE-2022-22824defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
  40Plan
• CVE-2022-22823build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.