CVE-2024-28757

libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-25)

CWE

CWE-776

Published

2024-03-10

Modified

2026-10-15

Record from

the NVD, synced 2026-10-19

Affected

• fedoraproject:fedora
• libexpat_project:libexpat
• netapp:active_iq_unified_manager
• netapp:h300s_firmware
• netapp:h410c_firmware
• netapp:h410s_firmware
• netapp:h500s_firmware
• netapp:h610c_firmware
• netapp:h610s_firmware
• netapp:h700s_firmware
• netapp:oncommand_workflow_automation
• netapp:ontap
• netapp:ontap_tools
• netapp:windows_host_utilities

References

• http://www.openwall.com/lists/oss-security/2024/03/15/1
• https://github.com/libexpat/libexpat/issues/839
• https://github.com/libexpat/libexpat/pull/842
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FPLC6WDSRDUYS7F7JWAOVOHFNOUQ43DD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKJ7V5F6LJCEQJXDBWGT27J7NAP3E3N7/

Check your stackJSON