CVE-2024-8176
Estado: AplazadaAlta (7.5)—
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.33%
- Percentil entre todas las CVEs puntuadas: 70
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access75 % - Impacto principal
T1499.004Application or System Exploitationimpact80 %
AV:N/AC:L/PR:N permite T1190. La descripción explícita de crash por desbordamiento de pila (CWE-674) y agotamiento de recursos confirma T1499.004 (application exhaustion).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-674
Referencias
- https://access.redhat.com/errata/RHSA-2025:13681
- https://access.redhat.com/errata/RHSA-2025:22033
- https://access.redhat.com/errata/RHSA-2025:22034
- https://access.redhat.com/errata/RHSA-2025:22035
- https://access.redhat.com/errata/RHSA-2025:22607
- https://access.redhat.com/errata/RHSA-2025:22785
- https://access.redhat.com/errata/RHSA-2025:22842
- https://access.redhat.com/errata/RHSA-2025:22871
- https://access.redhat.com/errata/RHSA-2025:3531
- https://access.redhat.com/errata/RHSA-2025:3734
- https://access.redhat.com/errata/RHSA-2025:3913
- https://access.redhat.com/errata/RHSA-2025:4048
- https://access.redhat.com/errata/RHSA-2025:4446
- https://access.redhat.com/errata/RHSA-2025:4447
- https://access.redhat.com/errata/RHSA-2025:4448
- https://access.redhat.com/errata/RHSA-2025:4449
- https://access.redhat.com/errata/RHSA-2025:7444
- https://access.redhat.com/errata/RHSA-2025:7512
- https://access.redhat.com/errata/RHSA-2025:8385
- https://access.redhat.com/security/cve/CVE-2024-8176
- https://bugzilla.redhat.com/show_bug.cgi?id=2310137
- https://github.com/libexpat/libexpat/issues/893
- https://github.com/libexpat/libexpat/pull/973
- http://seclists.org/fulldisclosure/2025/May/10
- http://seclists.org/fulldisclosure/2025/May/11
- http://seclists.org/fulldisclosure/2025/May/12
- http://seclists.org/fulldisclosure/2025/May/6
- http://seclists.org/fulldisclosure/2025/May/7
- http://seclists.org/fulldisclosure/2025/May/8
- http://www.openwall.com/lists/oss-security/2025/03/15/1
- http://www.openwall.com/lists/oss-security/2025/09/24/11
- https://blog.hartwork.org/posts/expat-2-7-0-released/
- https://bugzilla.suse.com/show_bug.cgi?id=1239618
- https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52
- https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53
- https://security-tracker.debian.org/tracker/CVE-2024-8176
- https://security.netapp.com/advisory/ntap-20250328-0009/
- https://ubuntu.com/security/CVE-2024-8176
- https://www.kb.cert.org/vuls/id/760160
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-8176",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-8176",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-03-14T13:13:22.690073Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "secalert@redhat.com",
"affectedData": [
{
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "2.7.0",
"versionType": "semver"
}
],
"packageName": "libexpat",
"collectionURL": "https://github.com/libexpat/libexpat/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "0:2.7.1-1.el10_0",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.5-17.el8_10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::crb",
"cpe:/o:redhat:enterprise_linux:8::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-11.el8_10",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.2::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.2::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-5.el8_2.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_e4s:8.4::baseos",
"cpe:/o:redhat:rhel_tus:8.4::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-5.el8_4.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_eus_long_life:8.4::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_e4s:8.4::baseos",
"cpe:/o:redhat:rhel_tus:8.4::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-5.el8_4.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.4::baseos",
"cpe:/o:redhat:rhel_e4s:8.4::baseos",
"cpe:/o:redhat:rhel_tus:8.4::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-5.el8_4.2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_6",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-6.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_6",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-6.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_6",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_aus:8.6::baseos",
"cpe:/o:redhat:rhel_e4s:8.6::baseos",
"cpe:/o:redhat:rhel_tus:8.6::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-6.el8_6.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:8.8::crb",
"cpe:/o:redhat:rhel_eus:8.8::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:1.51.0-8.el8_8.1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "xmlrpc-c",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8::baseos",
"cpe:/o:redhat:rhel_tus:8.8::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:rhel_e4s:8.8::baseos",
"cpe:/o:redhat:rhel_tus:8.8::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-1.el8_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.0-3.el9_5.3",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.0-5.el9_6",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.0-3.el9_5.3",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.0-5.el9_6",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.0::appstream",
"cpe:/o:redhat:rhel_e4s:9.0::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.2.10-12.el9_0.4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream",
"cpe:/o:redhat:rhel_e4s:9.2::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.0-1.el9_2.3",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.4::appstream",
"cpe:/o:redhat:rhel_eus:9.4::baseos"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:2.5.0-2.el9_4.3",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:devworkspace:0.33::el9"
],
"vendor": "Red Hat",
"product": "DevWorkspace Operator 0.33",
"versions": [
{
"status": "unaffected",
"version": "0.33-1744075017",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "devworkspace/devworkspace-project-clone-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:discovery:1.14::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Discovery 1.14",
"versions": [
{
"status": "unaffected",
"version": "1.14.3-1748529279",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "discovery/discovery-server-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:discovery:1.14::el9"
],
"vendor": "Red Hat",
"product": "Red Hat Discovery 1.14",
"versions": [
{
"status": "unaffected",
"version": "1.14.2-1748467619",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "discovery/discovery-ui-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "compat-expat1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "firefox",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "thunderbird",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "firefox",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "lua-expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "mingw-expat",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"packageName": "thunderbird",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"packageName": "firefox",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"packageName": "firefox:flatpak/firefox",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"packageName": "thunderbird",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"packageName": "thunderbird:flatpak/thunderbird",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"vendor": "Red Hat",
"product": "Red Hat OpenShift Container Platform 4",
"packageName": "rhcos",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
]
}
],
"published": "2025-03-14T09:15:14.157",
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2025:13681",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22033",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22034",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22035",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22607",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22785",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22842",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:22871",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3531",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3734",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:3913",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:4048",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:4446",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:4447",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:4448",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:4449",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:7444",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:7512",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2025:8385",
"source": "secalert@redhat.com"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-8176",
"source": "secalert@redhat.com"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2310137",
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/libexpat/libexpat/issues/893",
"source": "secalert@redhat.com"
},
{
"url": "https://github.com/libexpat/libexpat/pull/973",
"source": "secalert@redhat.com"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/10",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/11",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/12",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/6",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/7",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://seclists.org/fulldisclosure/2025/May/8",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/03/15/1",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.openwall.com/lists/oss-security/2025/09/24/11",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://blog.hartwork.org/posts/expat-2-7-0-released/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1239618",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes#L40-L52",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://gitlab.alpinelinux.org/alpine/aports/-/commit/d068c3ff36fc6f4789988a09c69b434db757db53",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security-tracker.debian.org/tracker/CVE-2024-8176",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20250328-0009/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://ubuntu.com/security/CVE-2024-8176",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://www.kb.cert.org/vuls/id/760160",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "secalert@redhat.com",
"description": [
{
"lang": "en",
"value": "CWE-674"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage."
},
{
"lang": "es",
"value": "Existe una vulnerabilidad de desbordamiento de pila en la librería libexpat debido a la forma en que gestiona la expansión recursiva de entidades en documentos XML. Al analizar un documento XML con referencias a entidades profundamente anidadas, libexpat puede verse forzado a recurrir indefinidamente, agotando el espacio de pila y provocando un bloqueo. Este problema podría provocar una denegación de servicio (DoS) o, en algunos casos, una corrupción de memoria explotable, según el entorno y el uso de la librería."
}
],
"lastModified": "2026-09-21T06:16:58.990",
"sourceIdentifier": "secalert@redhat.com"
}