[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDXtgqlqfToLzlBrPxvLmcX6-Og_zKSiw-B1FONDqJEE":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":20,"kevVulnerabilities":82,"topProductsByCves":83,"seoMetadata":85,"meta":94},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":19},17614,"libexpat_project",1,40,0,44,"2025-09-15","l",[16],{"id":17,"product_name":18,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},103539,"libexpat","Libexpat_project is a technology vendor with 1 tracked product and 40 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[21,30,38,43,49,54,59,66,72,77],{"cveId":22,"description":23,"publishedDate":24,"cvssScore":25,"cvssVersion":26,"severity":27,"isKev":28,"epssScore":29},"CVE-2022-25236","xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs.","2022-02-16",9.8,"v3.1","Critical",false,0.35271,{"cveId":31,"description":32,"publishedDate":33,"cvssScore":34,"cvssVersion":35,"severity":36,"isKev":28,"epssScore":37},"CVE-2009-3720","The updatePosition function in lib\u002Fxmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML, w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.","2009-11-03",5,"v2","Medium",0.27924,{"cveId":39,"description":40,"publishedDate":41,"cvssScore":34,"cvssVersion":35,"severity":36,"isKev":28,"epssScore":42},"CVE-2009-3560","The big2_toUtf8 function in lib\u002Fxmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib\u002Fxmlparse.c, a different vulnerability than CVE-2009-2625 and CVE-2009-3720.","2009-12-04",0.24313,{"cveId":44,"description":45,"publishedDate":46,"cvssScore":47,"cvssVersion":35,"severity":36,"isKev":28,"epssScore":48},"CVE-2013-0340","expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.","2014-01-21",6.8,0.19433,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":47,"cvssVersion":35,"severity":36,"isKev":28,"epssScore":53},"CVE-2015-1283","Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.","2015-07-23",0.18439,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":25,"cvssVersion":26,"severity":27,"isKev":28,"epssScore":58},"CVE-2016-0718","Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow.","2016-05-26",0.13335,{"cveId":60,"description":61,"publishedDate":62,"cvssScore":63,"cvssVersion":26,"severity":64,"isKev":28,"epssScore":65},"CVE-2016-4472","The overflow protection in Expat is removed by compilers with certain optimization settings, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted XML data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1283 and CVE-2015-2716.","2016-06-30",8.1,"High",0.11946,{"cveId":67,"description":68,"publishedDate":69,"cvssScore":70,"cvssVersion":26,"severity":64,"isKev":28,"epssScore":71},"CVE-2017-9233","XML External Entity vulnerability in libexpat 2.2.0 and earlier (Expat XML Parser Library) allows attackers to put the parser in an infinite loop using a malformed external entity definition from an external DTD.","2017-07-25",7.5,0.08739,{"cveId":73,"description":74,"publishedDate":75,"cvssScore":70,"cvssVersion":26,"severity":64,"isKev":28,"epssScore":76},"CVE-2018-20843","In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).","2019-06-24",0.07107,{"cveId":78,"description":79,"publishedDate":80,"cvssScore":70,"cvssVersion":26,"severity":64,"isKev":28,"epssScore":81},"CVE-2019-15903","In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XML_GetCurrentLineNumber (or XML_GetCurrentColumnNumber) then resulted in a heap-based buffer over-read.","2019-09-04",0.06643,[],[84],{"id":17,"product_name":18,"version_count":12,"cve_count":10,"kev_count":11,"last_cve_update":13},{"title":86,"metaDescription":87,"keywords":88,"structuredData":89},"Libexpat_project - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Libexpat_project covering 1 product with 40 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Libexpat_project vulnerabilities, Libexpat_project security, Libexpat_project CVE, Libexpat_project threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":90,"@type":91,"name":92,"description":87,"url":93},"https:\u002F\u002Fschema.org","Organization","Libexpat_project","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Flibexpat_project",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":95,"apiVersion":96},"2026-10-17T15:17:17.067Z","3.0"]