USN-8790-1: Expat vulnerabilities
Ubuntu patched three Expat denial-of-service vulnerabilities, including excessive memory allocation on crafted documents and an infinite loop on DTD content.
Ubuntu security notice USN-8790-1 fixes multiple Expat vulnerabilities. CVE-2025-59375 allows large memory allocation when parsing a small crafted document, enabling denial of service, and was only addressed in Ubuntu 24.04 LTS. CVE-2026-32776 involves incorrect handling of empty external parameter entity content causing crashes, and a third issue causes an infinite loop when processing certain DTD content.
- Expat XML parser flaws allow denial of service via crafted documents
- CVE-2025-59375 only fixed in Ubuntu 24.04 LTS
- Issues include memory exhaustion, crash, and infinite loop conditions
Vulnerabilities mentionedAll →
- CVE-2025-593757.51%libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsingpublished · libexpat project libexpat PoC ×2
It was discovered that Expat could be made to allocate large amounts of memory when parsing a small crafted document. An attacker could possibly use this issue to cause Expat to consume resources, leading to a denial of service. This issue was only addressed in Ubuntu 24.04 LTS. (CVE-2025-59375) It was discovered that Expat incorrectly handled empty external parameter entity content. An attacker could possibly use this issue to cause Expat to crash, resulting in a denial of service. (CVE-2026-32776) It was discovered that Expat incorrectly handled certain DTD content. An attacker could possibly use this issue to cause Expat to enter an infinite loop, resulting in a denial of service.…
This source does not provide full text. Read it at ubuntu.com.