CVE-2023-52425 json
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full...
published 2024-02-04 2 y ago modified 2026-10-15 25 d ago also EUVD-2023-57052 , JLSEC-2025-60
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.1%
- EPSS 2.1% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.
Patch / fix
- julia Expat_jll 2.6.2+0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
- Siemens SINEC NMS V3.0
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
- expat Debian 12 2.5.0-1+deb12u2
- expat Debian 14, Debian 13 2.6.0-1
debian advisories DEBIAN-CVE-2023-52425
- expat Ubuntu 22.04 LTS 2.4.7-1ubuntu0.3
- expat Ubuntu 24.04 LTS 2.6.0-1
ubuntu advisories UBUNTU-CVE-2023-52425
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- xmlrpc-c RHEL 8 1.51.0-9.el8_10
- xmlrpc-c-c++ RHEL 8 1.51.0-9.el8_10
- xmlrpc-c-client RHEL 8 1.51.0-9.el8_10
- xmlrpc-c-client++ RHEL 8 1.51.0-9.el8_10
- expat RHEL 8 2.2.5-11.el8_9.1
- expat RHEL 9 2.5.0-1.el9_3.1
- expat RHEL 8.2 AUS 2.2.10-1.el8_2
- expat RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 2.2.10-1.el8_4
red hat advisories RHSA-2025:22871RHSA-2025:22785RHSA-2025:22035RHSA-2024:4259RHSA-2024:3926RHSA-2024:2839
- expat Linux Micro 6.0 2.8.5-159998.1.1
- expat SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 2.8.5-150400.3.40.1
- python311 Linux Micro 6.1 3.11.12-slfo.1.1_1.1
- python311-core Linux Micro 6.1 3.11.12-slfo.1.1_1.1
- expat Linux Micro 6.1 2.7.1-slfo.1.1_1.1
- expat Linux Micro 6.0 2.7.1-1.1
- python311 Linux Micro 6.0 3.11.11-1.1
- python311-core Linux Micro 6.0 3.11.11-1.1
suse advisories SUSE-SU-2026:24323-1SUSE-SU-2026:4623-1SUSE-SU-2026:4615-1SUSE-SU-2025:20374-1SUSE-SU-2025:20311-1SUSE-SU-2025:20207-1
- python316 openSUSE Tumbleweed 3.16.0~a1-1.1
- python315 openSUSE Tumbleweed 3.15.0~a1-1.1
- clustershell openSUSE Tumbleweed 1.9.3-1.1
- python314 openSUSE Tumbleweed 3.14.0~a1-1.1
- python313 openSUSE Tumbleweed 3.13.0~b3-1.1
- expat openSUSE Tumbleweed 2.6.0-1.1
- python38 openSUSE Tumbleweed 3.8.19-1.1
- python310 openSUSE Tumbleweed 3.10.14-1.1
opensuse advisories openSUSE-SU-2026:12477-1openSUSE-SU-2025:15713-1openSUSE-SU-2025:15212-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14109-1openSUSE-SU-2024:13695-1
- xmlrpc-c AlmaLinux 8 1.51.0-9.el8_10
- xmlrpc-c-c++ AlmaLinux 8 1.51.0-9.el8_10
- xmlrpc-c-client AlmaLinux 8 1.51.0-9.el8_10
- xmlrpc-c-client++ AlmaLinux 8 1.51.0-9.el8_10
- expat AlmaLinux 8 2.2.5-11.el8_9.1
- expat AlmaLinux 9 2.5.0-1.el9_3.1
almalinux advisories ALSA-2024:4259ALSA-2024:1615ALSA-2024:1530
- xmlrpc-c Rocky Linux 8 1.51.0-9.el8_10
- expat Rocky Linux 8 2.2.5-11.el8_9.1
rocky linux advisories RLSA-2024:4259RLSA-2024:1615
- expat Alpine 3.24, Alpine 3.23, Alpine 3.22 +6 more 2.6.0-r0
alpine advisories ALPINE-CVE-2023-52425
Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- expat CBL-Mariner 2.0 2.6.2-2
- expat Azure Linux 3.0 2.6.2-1
azure linux advisories AZL-34207AZL-34683
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2023-52425 updated cvss 7.5
expat: parsing large tokens can trigger a denial of service
-
Red Hat Enterprise Linux 6 expat Red Hat Enterprise Linux 7 expat, firefox, thunderbirdaffected: workaround, no fix planned “Out of support scope”
-
Red Hat Enterprise Linux 8 firefox, thunderbird Red Hat Enterprise Linux 9 firefox, firefox-x11, thunderbirdaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Enterprise Linux AppStream (v. 9) expat-devel 2.5.0-1.el9_3.1, expat-debuginfo 2.5.0-1.el9_3.1, expat-debugsource 2.5.0-1.el9_3.1fixed: vendor fix RHSA-2024:1530
-
Red Hat Enterprise Linux AppStream EUS (v.9.2) expat-devel 2.5.0-1.el9_2.1, expat-debuginfo 2.5.0-1.el9_2.1, expat-debugsource 2.5.0-1.el9_2.1fixed: vendor fix RHSA-2024:3926
-
Red Hat Enterprise Linux BaseOS (v. 8) expat 2.2.5-11.el8_9.1, xmlrpc-c 1.51.0-9.el8_10, xmlrpc-c-client 1.51.0-9.el8_10fixed: vendor fix RHSA-2024:4259
-
Red Hat Enterprise Linux BaseOS (v. 9) expat 2.5.0-1.el9_3.1fixed: vendor fix RHSA-2024:1530
-
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) expat 2.2.10-1.el8_2fixed: vendor fix RHSA-2025:22871
-
Red Hat Enterprise Linux BaseOS AUS (v.8.4) expat 2.2.10-1.el8_4fixed: vendor fix RHSA-2025:22785
show 8 moreshow fewer
-
Red Hat Enterprise Linux BaseOS E4S (v.9.0) expat 2.2.10-12.el9_0.4fixed: vendor fix RHSA-2025:22035
-
Red Hat Enterprise Linux BaseOS EUS (v.8.6) expat 2.2.5-8.el8_6.5fixed: vendor fix RHSA-2024:2839
-
Red Hat Enterprise Linux BaseOS EUS (v.8.8) expat 2.2.5-11.el8_8.2fixed: vendor fix RHSA-2024:2575
-
Red Hat Enterprise Linux BaseOS EUS (v.9.2) expat 2.5.0-1.el9_2.1fixed: vendor fix RHSA-2024:3926
-
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) expat 2.2.10-1.el8_4fixed: vendor fix RHSA-2025:22785
-
Red Hat Enterprise Linux CRB (v. 8) xmlrpc-c-c++ 1.51.0-9.el8_10, xmlrpc-c-client++ 1.51.0-9.el8_10fixed: vendor fix RHSA-2024:4259
-
Red Hat JBoss Core Services 2.4.62fixed: vendor fix RHSA-2025:3453
-
Red Hat Enterprise Linux AppStream E4S (v.9.0) expat-devel 2.2.10-12.el9_0.4, expat-debuginfo 2.2.10-12.el9_0.4, expat-debugsource 2.2.10-12.el9_0.4 Red Hat Enterprise Linux BaseOS AUS (v. 8.2) expat 2.2.10-1.el8_2 Red Hat Enterprise Linux BaseOS AUS (v.8.4) expat 2.2.10-1.el8_4 Red Hat Enterprise Linux BaseOS E4S (v.9.0) expat 2.2.10-12.el9_0.4 Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) expat 2.2.10-1.el8_4not affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
cisa ICSA-23-348-10 updated cvss 7.5
Siemens SIMATIC S7-1500
-
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5affected: fixed in V3.1.5, mitigation support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
cisa ICSA-24-228-06 updated cvss 7.5
Siemens SINEC NMS
-
Siemens SINEC NMS <V3.0affected: fixed in V3.0 support.industry.siemens.com
Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
2.15% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/libexpat/libexpat/pull/789 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| julia | Expat_jll | <2.6.2+0 |
2.6.2+0 |
Affected products
- libexpat_project libexpat
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
- Siemens SINEC NMS
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/libexpat/libexpat/pull/789
exploit, vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
vendor-advisory, web
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/WNUBSGZFEZOBHJFTAD42SAN4ATW2VEMV/
vendor-advisory, web
-
lists.debian.org
/debian-lts-announce/2024/04/msg00006.html
mailing-list, web
-
openwall.com
/lists/oss-security/2024/03/20/5
mailing-list, web
-
security.netapp.com
/advisory/ntap-20240614-0003/
web
-
lists.debian.org
/debian-lts-announce/2024/09/msg00036.html
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/PNRIHC7DVVRAIWFRGV23Y6UZXFBXSQDB/
web
- cert-portal.siemens.com /productcert/html/ssa-398330.html
- cert-portal.siemens.com /productcert/html/ssa-784301.html
Sources
- CVE List CVE-2023-52425
- NVD CVE-2023-52425
- OSV JLSEC-2025-60
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.