CVE-2024-8176

March 15, 2025, 7:15 p.m.

7.5
High

Description

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

Product(s) Impacted

Vendor Product Versions
Expat
  • Libexpat
  • *

Weaknesses

CWE-674
Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

*CPE(s)

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a expat libexpat / / / / / / / /

References

https://access.redhat.com/security/cve/CVE-2024-8176
https://bugzilla.redhat.com/show_bug.cgi?id=2310137
https://github.com/libexpat/libexpat/issues/893
http://www.openwall.com/lists/oss-security/2025/03/15/1

Tags

secalert@redhat.com
CWE-674
2025-03-14
CVE-2024-8176

CVSS Score

7.5 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Date

  • Published: March 14, 2025, 9:15 a.m.
  • Last Modified: March 15, 2025, 7:15 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.