{"cve":"CVE-2013-1664","nvd":{"published":"2013-04-03T00:55:02.177","modified":"2026-06-16T23:51:51.753","status":"Modified","description":"The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-119"],"references":["http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html","http://bugs.python.org/issue17239","http://lists.openstack.org/pipermail/openstack-announce/2013-February/000078.html","http://rhn.redhat.com/errata/RHSA-2013-0657.html","http://rhn.redhat.com/errata/RHSA-2013-0658.html"],"products":["openstack:cinder_folsom","openstack:compute_\\(nova\\)_essex","openstack:compute_\\(nova\\)_folsom","openstack:folsom","openstack:grizzly","openstack:keystone_essex"],"source":"nvd","synced_at":"2026-10-19T20:27:27.940201468+00:00"},"epss":{"cve":"CVE-2013-1664","score":0.04771,"percentile":0.91911,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qrh7-x6fp-c2mp","url":"https://osv.dev/vulnerability/GHSA-qrh7-x6fp-c2mp","summary":"XML Entity Expansion (XEE) in Django","modified":"2026-07-07T11:56:25.238206568Z","packages":[{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=1.3.0 <1.3.6"],"fixed":["1.3.6"]},{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=1.4.0 <1.4.4"],"fixed":["1.4.4"]}]},{"id":"PYSEC-2026-801","url":"https://osv.dev/vulnerability/PYSEC-2026-801","summary":"XML Entity Expansion (XEE) in Django","modified":"2026-07-07T11:45:45.080373502Z","packages":[{"ecosystem":"PyPI","name":"django","purl":"pkg:pypi/django","ranges":[">=1.3.0 <1.3.6",">=1.4.0 <1.4.4"],"fixed":["1.3.6","1.4.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}