| CVE-2026-41080 | FAIBLE2.9 | libexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document. | 16/04/2026 |
| CVE-2026-32778 | MOYENNE5.5 | libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. | 16/03/2026 |
| CVE-2026-32777 | MOYENNE5.5 | libexpat before 2.7.5 allows an infinite loop while parsing DTD content. | 16/03/2026 |
| CVE-2026-32776 | MOYENNE5.5 | libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. | 16/03/2026 |
| CVE-2026-25210 | ÉLEVÉE7.8 | In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation. | 30/01/2026 |
| CVE-2026-24515 | FAIBLE2.5 | In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. | 23/01/2026 |
| CVE-2025-66382 | MOYENNE5.5 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. | 28/11/2025 |
| CVE-2025-59375 | ÉLEVÉE7.5 | libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing. | 15/09/2025 |
| CVE-2024-50602 | MOYENNE5.9 | An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser. | 27/10/2024 |
| CVE-2024-45492 | CRITIQUE9.8 | An issue was discovered in libexpat before 2.6.3. nextScaffoldPart in xmlparse.c can have an integer overflow for m_groupSize on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | 30/08/2024 |
| CVE-2024-45491 | CRITIQUE9.8 | An issue was discovered in libexpat before 2.6.3. dtdCopy in xmlparse.c can have an integer overflow for nDefaultAtts on 32-bit platforms (where UINT_MAX equals SIZE_MAX). | 30/08/2024 |
| CVE-2024-45490 | ÉLEVÉE7.5 | An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer. | 30/08/2024 |
| CVE-2024-28757 | ÉLEVÉE7.5 | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). | 10/03/2024 |
| CVE-2023-52426 | MOYENNE5.5 | libexpat through 2.5.0 allows recursive XML Entity Expansion if XML_DTD is undefined at compile time. | 04/02/2024 |
| CVE-2023-52425 | ÉLEVÉE7.5 | libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed. | 04/02/2024 |
| CVE-2022-43680 | ÉLEVÉE7.5 | In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. | 24/10/2022 |
| CVE-2022-40674 | ÉLEVÉE8.1 | libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. | 14/09/2022 |
| CVE-2022-25315 | CRITIQUE9.8 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. | 18/02/2022 |
| CVE-2022-25314 | ÉLEVÉE7.5 | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. | 18/02/2022 |
| CVE-2022-25313 | MOYENNE6.5 | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. | 18/02/2022 |