CVE-2024-8176 — Uncontrolled Recursion in Expat
Severity
7.5HIGHNVD
EPSS
0.4%
top 38.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 14
Latest updateMar 3
Description
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6
Affected Packages16 packages
🔴Vulnerability Details
2GHSA▶
GHSA-9hcv-xw76-m4h6: A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents↗2025-03-14
OSV▶
CVE-2024-8176: A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents↗2025-03-14