CVE-2018-20843

In libexpat in Expat before 2.2.7, XML input including XML names that contain a large number of colons could make the XML parser consume a high amount of RAM and CPU resources while processing (enough to be usable for denial-of-service attacks).

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

7.1% chance of exploitation in the next 30 days; higher than 94% of CVEs (scores of 2026-10-25)

CWE

CWE-611

Published

2019-06-24

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• canonical:ubuntu_linux
• debian:debian_linux
• fedoraproject:fedora
• libexpat_project:libexpat
• opensuse:leap
• oracle:hospitality_res_3700
• oracle:http_server
• oracle:outside_in_technology
• tenable:nessus

References

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00039.html
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5226
• https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes
• https://github.com/libexpat/libexpat/issues/186
• https://github.com/libexpat/libexpat/pull/262

Check your stackJSON