Skip to content
Fencer Vulns
medium 5.9

CVE-2024-50602 json

An issue was discovered in libexpat before 2.6.4

published 2024-10-27 2 y ago modified 2026-10-15 25 d ago also BIT-libpython-2024-50602 , BIT-python-2024-50602 , BIT-python-min-2024-50602 , EUVD-2024-44973 , JLSEC-2025-65

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

Patch / fix

  • bitnami libpython 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1
  • bitnami python 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1
  • bitnami python-min 3.9.21, 3.10.16, 3.11.11, 3.12.8, 3.13.1
  • julia Expat_jll 2.6.4+0
  • libexpat_project libexpat 2.6.4
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens RUGGEDCOM ROX MX5000 V2.17.0
  • Siemens RUGGEDCOM ROX MX5000RE V2.17.0
  • Siemens RUGGEDCOM ROX RX1400 V2.17.0
  • Siemens RUGGEDCOM ROX RX1500 V2.17.0
  • Siemens RUGGEDCOM ROX RX1501 V2.17.0
  • Siemens RUGGEDCOM ROX RX1510 V2.17.0
  • Siemens RUGGEDCOM ROX RX1511 V2.17.0
  • Siemens RUGGEDCOM ROX RX1512 V2.17.0
  • Siemens RUGGEDCOM ROX RX1524 V2.17.0
  • Siemens RUGGEDCOM ROX RX1536 V2.17.0
  • Siemens RUGGEDCOM ROX RX5000 V2.17.0
  • Siemens RUGGEDCOM RST2428P V3.2
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family V3.2
  • Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family V3.2
  • expat Debian 12 2.5.0-1+deb12u2
  • expat Debian 14, Debian 13 2.6.3-2

debian advisories DEBIAN-CVE-2024-50602

  • expat Ubuntu 20.04 LTS 2.2.9-1ubuntu0.8
  • expat Ubuntu 22.04 LTS 2.4.7-1ubuntu0.5
  • expat Ubuntu 24.04 LTS 2.6.1-2ubuntu0.2
  • expat Ubuntu Pro 14.04 LTS 2.1.0-4ubuntu1.4+esm10
  • expat Ubuntu Pro 16.04 LTS 2.1.0-7ubuntu0.16.04.5+esm10
  • expat Ubuntu Pro 18.04 LTS 2.2.5-3ubuntu0.9+esm2

ubuntu advisories UBUNTU-CVE-2024-50602

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • expat RHEL 9 2.5.0-3.el9_5.1
  • expat RHEL 8 2.2.5-16.el8_10
  • expat RHEL 9.2 EUS 2.5.0-1.el9_2.2
  • expat RHEL 9.4 EUS 2.5.0-2.el9_4.2

red hat advisories RHSA-2025:3350RHSA-2024:11200RHSA-2024:9541RHSA-2024:9502

  • mozjs60 SLE Module for Desktop Applications 15 SP7, SLE Module for Basesystem 15 SP7, SLE Micro 5.4 +3 more 60.9.0-150200.6.8.1
  • mozjs52 SLE Module for Package Hub 15 SP7, openSUSE Leap 15.6 52.6.0-150000.3.9.1
  • expat Linux Micro 6.1 2.7.1-slfo.1.1_1.1
  • expat Linux Micro 6.0 2.7.1-1.1
  • expat Linux Micro 6.1 2.5.0-slfo.1.1_2.1
  • expat Linux Micro 6.0 2.5.0-4.1
  • mozjs78 SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, SLE Module for Desktop Applications 15 SP5 +2 more 78.15.0-150400.3.11.1
  • mozjs115 SLE Module for Desktop Applications 15 SP6, openSUSE Leap 15.6 115.4.0-150600.3.6.1

suse advisories SUSE-SU-2026:0044-1SUSE-SU-2025:4512-1SUSE-SU-2025:20311-1SUSE-SU-2025:20207-1SUSE-SU-2025:20258-1SUSE-SU-2025:20086-1

  • paraview openSUSE Tumbleweed 5.12.1-2.1
  • mozjs115 openSUSE Tumbleweed 115.15.0-3.1
  • mozjs128 openSUSE Tumbleweed 128.5.1-2.1
  • mozjs78 openSUSE Tumbleweed 78.15.0-7.1
  • expat openSUSE Tumbleweed 2.6.4-1.1
  • audacity openSUSE Tumbleweed 3.7.0-1.1
  • gama openSUSE Tumbleweed 2.31-1.1
  • xsd openSUSE Tumbleweed 4.1.0-3.1

opensuse advisories openSUSE-SU-2024:14609-1openSUSE-SU-2024:14587-1openSUSE-SU-2024:14588-1openSUSE-SU-2024:14589-1openSUSE-SU-2024:14477-1openSUSE-SU-2024:14457-1

  • expat AlmaLinux 8 2.2.5-16.el8_10
  • expat AlmaLinux 9 2.5.0-3.el9_5.1

almalinux advisories ALSA-2024:9502ALSA-2024:9541

  • expat Rocky Linux 8 2.2.5-16.el8_10

rocky linux advisories RLSA-2024:9502

  • expat Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 2.6.4-r0
  • qt6-qtwebengine Alpine 3.24, Alpine 3.23, Alpine 3.22 6.8.3-r1

alpine advisories ALPINE-CVE-2024-50602

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • expat CBL-Mariner 2.0, Azure Linux 3.0 2.6.3-2

azure linux advisories AZL-51684AZL-51735

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-50602 updated cvss 5.9

libexpat: expat: DoS via XML_ResumeParser

  • Red Hat Enterprise Linux 7 expat
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 mingw-expat, mingw32-expat, mingw64-expat
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 9) expat-devel 2.5.0-3.el9_5.1, expat-debuginfo 2.5.0-3.el9_5.1, expat-debugsource 2.5.0-3.el9_5.1
    fixed: vendor fix RHSA-2024:9541
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) expat-devel 2.5.0-1.el9_2.2, expat-debuginfo 2.5.0-1.el9_2.2, expat-debugsource 2.5.0-1.el9_2.2
    fixed: vendor fix RHSA-2025:3350
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) expat-devel 2.5.0-2.el9_4.2, expat-debuginfo 2.5.0-2.el9_4.2, expat-debugsource 2.5.0-2.el9_4.2
    fixed: vendor fix RHSA-2024:11200
  • Red Hat Enterprise Linux BaseOS (v. 8) expat 2.2.5-16.el8_10
    fixed: vendor fix RHSA-2024:9502
  • Red Hat Enterprise Linux BaseOS (v. 9) expat 2.5.0-3.el9_5.1
    fixed: vendor fix RHSA-2024:9541
  • Red Hat Enterprise Linux BaseOS EUS (v.9.2) expat 2.5.0-1.el9_2.2
    fixed: vendor fix RHSA-2025:3350
show 2 more
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) expat 2.5.0-2.el9_4.2
    fixed: vendor fix RHSA-2024:11200
  • Red Hat Enterprise Linux 10 expat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-25-226-07 updated cvss 5.5

Siemens Third-Party Components in SINEC OS

  • Siemens RUGGEDCOM RST2428P (6GK6242-6PA00) < 3.2
    affected: fixed in V3.2 support.industry.siemens.com
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family < 3.2
    affected: fixed in V3.2
  • Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family < 3.2
    affected: fixed in V3.2 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.12% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami libpython
<3.9.21
>=3.10.0, <3.10.16
>=3.11.0, <3.11.11
>=3.12.0, <3.12.8
>=3.13.0, <3.13.1
3.9.21
3.10.16
3.11.11
3.12.8
3.13.1
bitnami python
<3.9.21
>=3.10.0, <3.10.16
>=3.11.0, <3.11.11
>=3.12.0, <3.12.8
>=3.13.0, <3.13.1
3.9.21
3.10.16
3.11.11
3.12.8
3.13.1
bitnami python-min
<3.9.21
>=3.10.0, <3.10.16
>=3.11.0, <3.11.11
>=3.12.0, <3.12.8
>=3.13.0, <3.13.1
3.9.21
3.10.16
3.11.11
3.12.8
3.13.1
julia Expat_jll
<2.6.4+0
2.6.4+0

Affected products

  • libexpat_project libexpat
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens RUGGEDCOM ROX MX5000
  • Siemens RUGGEDCOM ROX MX5000RE
  • Siemens RUGGEDCOM ROX RX1400
  • Siemens RUGGEDCOM ROX RX1500
  • Siemens RUGGEDCOM ROX RX1501
  • Siemens RUGGEDCOM ROX RX1510
  • Siemens RUGGEDCOM ROX RX1511
  • Siemens RUGGEDCOM ROX RX1512
  • Siemens RUGGEDCOM ROX RX1524
  • Siemens RUGGEDCOM ROX RX1536
  • Siemens RUGGEDCOM ROX RX5000
  • Siemens RUGGEDCOM RST2428P
  • Siemens SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family
  • Siemens SCALANCE XCM-/XRM-/XCH-/XRH-300 family

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.