CVE-2025-66382
published 2025-11-28CVE-2025-66382: In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
PriorityP421medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.21%
10.8th percentile
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | expat | — | — |
| libexpat_project | libexpat | <= 2.7.3 | — |
| msrc | azl3_expat_2.6.4-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_expat_2.6.4-4_on_azure_linux_3.0 | — | — |
| msrc | cbl2_expat_2.6.4-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_expat_2.6.4-3_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_expat_2.6.4-4_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian2.9LOW
vendor_msrc2.9LOW
vendor_redhat2.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-66382: In libexpat through 2
osv·2025-11-28·CVSS 5.5
CVE-2025-66382 [MEDIUM] CVE-2025-66382: In libexpat through 2
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
GHSA
GHSA-93q9-crcw-vwgq: In libexpat through 2
ghsa_unreviewed·2025-11-28
CVE-2025-66382 [LOW] CWE-407 GHSA-93q9-crcw-vwgq: In libexpat through 2
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
Red Hat
libexpat: libexpat: Denial of service via crafted file processing
vendor_redhat·2025-11-28·CVSS 2.9
CVE-2025-66382 [LOW] CWE-407 libexpat: libexpat: Denial of service via crafted file processing
libexpat: libexpat: Denial of service via crafted file processing
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
A flaw was found in libexpat. This vulnerability allows a denial of service (DoS) by processing a crafted file with an approximate size of 2 MiB, leading to dozens of seconds of processing time.
Statement: The highest threat of this flaw is to system availability. This issue affects systems that process untrusted XML files with libexpat, where a specially crafted file can lead to extended processing times, potentially causing a denial of service.
Package: expat (Red Hat Enterprise Linux 10) - Fix deferred
Package: firefox (Red Hat Enterprise Linux 10) - Fix deferred
Package: thunderbird (Red Hat
Microsoft
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
vendor_msrc·2025-11-11·CVSS 2.9
CVE-2025-66382 [LOW] CWE-407 In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
Mariner: Mariner
mitre: mitre
Customer Action Required: Yes
Debian
CVE-2025-66382: expat - In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can ...
vendor_debian·2025·CVSS 2.9
CVE-2025-66382 [LOW] CVE-2025-66382: expat - In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can ...
In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
2025-11-28
Published